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You have a 

LEGAL RIGHT 

to 9m unlocked 
backup copy 

of your 

commercial 

softiMfare 



Our editorial policy is that we do NOT condone 
software piracy, but v\re do believe that users are entitled 
to backup commercial disks they have purchased. 

In addition to the security of a backup disk, the removal 
of copy-protection gives the user the option of modifying 
programs to meet his or her needs. 

Furthermore, the copyright laws guarantee your right 
to such a DEPROTECTED backup copy: 



..."It is not an infringement for the owner of a copy of 
a computer program to make or authorize the making of 
another copy or adaptation of that computer program 
provided: 

1) that such a new copy or adaptation is created as an 
essential step in the utilization of the computer program in 
conjunction with a machine and that it is used in no other 
manner, or 

2) that such new copy or adaptation is for archival 
purposes only and that all archival copies are destroyed in 
the event that continued possession of tlie computer program 
should cease to be rightful. 

Any exact copies prepared in accordance with the 
provisions of this section may be leased, sold, or otherwise 
transferred, along with the copy from which such copies 
were prepared, only as part of the lease, sale, or other 
transfer of all rights in the program. Adaptations so prepared 
may be transferred only with the authorization of the 
copyright owner." 



United States Code title 17, §117 
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Attention Apple-users: 
Why type those 
l-o-n-g listings when 
you can just Upgrade 
your present sub. to a 
Mag/5V4"Disk Combo 
subscription 

■ You may upgrade your current 
subscription to a magazine & disk 
combination by sending $5.50 ($6.50 
foreign) per remaining issue. 

Time to renew? 

■ Check your mailing label to see if you 
need to renew your subscription. 

D Use the order form on this page to 
renew, and don't forget to send your most 
current mailing label to help expedite your 
renewal 

Moving soon? 

■ If you're moving, let us know at least 30 
days in advance. 

■ Issues missed due to non-reciept of 
Change-of-Address may be acquired at the 
regular back issue rates. 

■ Remember, the Post Office does not 
forward third class mail unless requested. 
COMPUTIST is not responsible for 
replacing issues lost while forwarding order 
is in effect. 






Yes, I want to subscribe to COMPUTIST. Enclosed are funds for an annual (12 issue) subscription. 



I am... D A new subscriber 

n Renewing my current subscription 

D Changing my address (please include last mall label) 
I have..D an Apple lie, llgs or Ik computer 

D an IBM computer 

Apple— IBM subscription... 
D U.S. • $32 

D U.S./Canada/Mexico First Class ■ $45 
D All other Foreign - $75 

Apple mag-disk combination subscription... 
n U.S./Canada/Mexico First Class plus Library Disk • $100 
D All other Foreign plus Library Disk • $ 1 40 

U.S. Funds drawn on U.S. bank. Allow 4—8 weeks for first issue. 



Ncime. 
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State 



Zip 



Country. 



.Phone_ 
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I Send your letters on disk 

I've been getting more and more of your letters, on disk and it's great. I love it. A lot less 
editing and a lot less errors. Of course, if you're one of the people who sent your letter as hardcopy 
(on paper), you are probably not to thrilled with my response time. (I'm about 2 months behind 
in my written correspondence.) I'm making a special effort and I'll have most of your letters typed 
and in the next COMPUTIST. (I hope.) I do want to say again and reemphasize, if your letter 
is more than lialfofa page, please send it on disk. I'm very good about returning disks. But I'm 
a rotten typist (die-hard two finger and a thumb type). I wish we had a real typist but they normally 
don't work for free. In fact, I wish we had a few hundred more subscribers so I could also add 
another 16 pages for all the new stuff that has been coming in on disk. 

I Questions 

The following are some questions that got a chuckle out of Karen. She's the person who answers 
the phone, processes and packs your orders, as well as entering new subscriptions and renewals 
into the computer. Be nice to her, she works a fiill day and only gets minimum wage. If she doesn't 
process your order, we would have too. (You wouldn't want someone who types with two fingers 
to enter and pack your order, would you?) 

From a non-subscriber who ordered a back issue from an ad flyer: 
Q. Along with my order, do I get the ($32 value) free subscription? 

A. Nice try. The subscription is $32. The FREE software package ($32 value) comes with it. 
Gotta buy one to get the other. 

From a subscriber who was renewing: 
Q. Please send a list of currendy available products (Disks & Books). 
A. We send you a new updated list every month. All our products are listed in the back of each 
issue, however, we have access to a number of wholesalers. If there is something you're looking 
for, write and ask, we'll tell you the best price we can find. 

From a new Foreign subscriber: 
Q. I would like to ask you. How come the back issues are more expensive then the subscription? 
A. Because we want you to subscribe... Sorry, just kidding. Regular subscriptions are handled 
automatically once a month by a mail fowarding service. All of the foreign orders are picked up 
here and flown to New York where they are sorted and flown to their respective countries. There 
they are put into the regular mail system. Back issue orders must be handled on an individual 
basis and sent by regular mail service (1st Class Air). That means they cost more to send and 
take more time to process. 

I Starter Kit Woes! 

If your printer just spews paper when you try to print the DOC files, try this tip; when the 
program asks for the right margin (80), it really wants to know the right indent (normally 0). 
Tell it zero and things should work fine. Just a syntax problem with the man who wrote the print 
routine. Mike say's he'll have it fixed in a jiffy. 

I Missed Issues? 

Issues are mailed at the end of each month and can take up to 4 weeks to get to you. (Depends 
on where you are and what the US snail is doing about then.) Give the issue enough time to get 
to you. But, if you feel that too much time has gone by without a COMPUTIST appearing in 
your mail, write to Karen (or call). Don't wait for 6 months before you say anything. Karen can 
be very unsympathetic to your tale of woe and will only replace the last issue or two. 



BUGS: 



COMPUTIST #58, page 32. Computing for 1-3 year olds - In listing 1 , there is an extra open 
parenthesis in line 220. It should read: 

220 NN= INT(RND(1) * FC + 1) 
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New COMPUTIST readers using Apple lis 
are advised to read this page carefully to avoid 
frustration when attempting to follow a softkey 
or entering the programs printed in this issue. 

What is a softkey, anyway? 

Softkey is a terai which we coined to describe 
a procedure that removes, or at least 
circumvents, any copy-protection on a 
particular disk. Once a softkey procedure has 
been performed, the resulting backup copy can 
usually be copied by the normal copy programs 
(for example: COPYA, on the DOS 3.3 System 
Master disk). 

Comniaiids and control keys 

Commands which a reader is required to 
perform are set apart b y being in boldface and 
on a separate line. The iRETOMll key must be 
pressed at the end of every such command 
unless otherwise specified. Control characters 
are specially boxed. An example of both is: 

6 [BP| 

Press [s]. Next, place one finger on the CE3 
key and th en press [p]. Don't forget to press 
iBETOBWl . 

Other sp ecial combination keypresses include 
iBHKSETl or KiBRESETl . In the former , 
press and hold down (=3 then press IresktI . 
In t he lat ter, press a nd hold down both E3 
and I CS I then press iKESErl . 

Software recommendations 

The Starter Kit contains most of the programs 
that you need to ' 'Get started' ' . In addition, we 
recommend that you aquire the following: 

• Applesoft program editor such as "Global 
Program Line Editor (GPLE)". 

• Assembler such as the "S-C Assembler" 
from S-C software or "Merlin/Big Mac". 

• Bit-copy program such as "Copy n Plus", 
"Lxxjksmith" or "Essential Data Duplicator 
(EDD)". 

• Text-editor (that produces normal sequential 
text files) such as "Applewriter 11", "Magic 
Window n" or "Screenwriter H". 

• "COPYA", "FID" and "MUFFIN" fi^om 
the DOS 3.3 System Master disk are also 
usefiil. 

Super lOB and Controllers 

This powerfijl deprotection utility (in the 
COMPUTIST Starter Kit) and its various 
Controllers are used in many softkeys. (It is also 
on each Super lOB Collection disk.) 



Reset into the Monitor 

Softkeys occasionally require the user to stop 
the execution of a copy-protected program and 
directly enter the Apple's system monitor. 
Check the following list to see what hardware 
you will need to obtain this ability. 

Apple n + , lie, compatibles: 1) Place an 
Integer BASIC ROM card in one of the Apple 
slots. 2) Use a non-maskable interrupt (NMI) 
card such as Replay or Wildcard. 

Apple II + , compatibles: 1) Install an F8 
ROM with a modified reset-vector on the 
computer's motherboard as detailed in the 
"Modified ROM's" article (COMPUTIST #6 
or Book Of Softkeys HI) or the "Dual 
ROM's" article (COMPUTIST #19). 

Apple lie, lie: Install a modified CD ROM 
on the computer's motherboard. Cutting Edge 
Ent. (Box 43234 Ren Cen Station-HC; Detroit, 
MI 48243) sells a hardware device that will give 
you this important ability but it will void an 
Apple //c warranty. 

Apple //gs: If you have the 2.x ROM, there 
is a hidden classic desk accessory (CDA) that 
allows you to enter the monitor. In order to 
install the new CDA, you should enter the 
monitor before running any p rotected p rograms 
(CALL -151) and press "# iREniRllI ". This 
will turn on two hidden CDAs, Mem ory Peeker 
and Visit Monitor. Thereafter press IcSBESC I 
to go to the Desk Accessories menu. Select 
"Visit Monitor" and there you are. Use |BY| 
to exit. 

Recommended literature: 

• Apple II Reference Manual 
m DOS 3.3 manual 

• Beneath Apple DOS & Beneath Apple 
ProDOS, by Don Worth and Pieter 
Lechner, from Quality Software 

Keying in Applesoft programs: 

BASIC programs are printed in a format that 
is designed to minimize errors for readers who 
key in these programs. If you type: 

lOHOUEiREMCLEAR SCREEN 

The LIST will look like: 

10 HOME : REM CLEAR SCREEN 

...because Applesoft inserts spaces into a 
program listing before and after every command 
word or mathematical operator. These spaces 
don't pose a problem except when they are 
inside of quotes or after a DATA command. 
There are two types of spaces: those that have 
to be keyed and those that don't. Spaces that 



must be typed appear in COMPUTIST as delta 
characters ('). AH other spaces are there for 
easier reading. NOTE: If you want your 
checksums (See Computing checksmns) to 
match up, only type spaces within quotes or 
after DATA statements if they are shown as 
delta C) charactors. 

Keying In Hexdumps 

Machine language programs are printed in 
COMPUTIST as hexdumps, sometimes also as 
source code. Hexdumps are the shortest and 
easiest format to type in. You must first enter 
the monitor: 

CAU-151 

Key in the hexdump exactly as it appears in 
the magazine, ignoring the four-digit checksum 
($ and four digits) at the end of each line. When 
finished, return to BASIC with: 
3D0G 

BSAVE the program with the filename, 
address and length parameters given in the 
article. 

The source code is printed to help explain a 
program's operation. To enter it, you need an 
"Assembler". Most of the source code is in 
S-C Assembler format. If you use a different 
assembler, you will have to translate pieces of 
the source code into something your assembler 
will understand. 

Computing checksums 

Checksums are 4-digit hexadecimal numbers 
which tell if you typed a program correctly. 
There are two types of checksums: one created 
by the CHECKBIN program (for machine 
language programs) and the other created by 
the CHECKSOFT program (for BASIC 
programs). Both are on the "Starter Kit". 

If your checksums do not match the published 
checksums then the line where the first 
checksum differs is incorrect. 

CHECKSOFT instructions: Install Checksoft 
(BRUN CHECKSOFT) then LOAD your 
program. Press I fc I to get the checksums. 
Correct the program line where the checksums 
differ. 

CHECKBIN instructions: Enter the monitor 
(CALL -151), install Checkbin at some out of 
the way place (BRUN CHECKBIN, A$6000), 
and then LOAD your program. Get the 
checksums by typing the Starting address, a 
period and th e En ding address of the file 
followed by a iBTl . 



Correct the lines at which the checksums 
differ RDEXed 
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when 
writing a 
letter to the. 




RD&X ediim 



RDEX stands for: 

Reader's Data Exchange 

That means that when you send in 
articles, softkeys, APTs, etc., you are 
submitting them for FREE publication in 
this magazine. RDEX does NOT 
purchase submissions nor do we verify 
data submitted by readers. We print 
what you write. If you discover any 
errors, please let us know. 

• Remember that your letters or parts 
of them may be used in RDEX even if 
not addressed to the RDEX editor. 
Correspondence that gets published may 
be edited for clarity, grammar and space 
requirements . 

• Because of the great number of letters 
we receive and the ephemeral and 
unpredictable appearance of our part- 
time staff, any response to your queries 
will appear only in RDEX, so it would 
be more appropriate for you to present 
technical questions to the readers and ask 
for their responses which will then be 
placed in the Apple-RDEX. 

• Whenever possible, send your articles 
and letters on disk as standard text files. 
When we get your letter-article in a text 
file, it is immediately uploaded into the 
most current RDEX file. We will return 
your disks, whenever possible, with the 
current library disk copied onto it. 
Conventional letters must be typed in by 
us... when we have the time. 

• When you send your material on disk, 
try to use a disk formatted for Apple 
DOS 3.3. It makes things a lot easier for 
us . 

• Address your letters, articles, to: 

COMPUTIST 

RDEX Editor 

PO Box 110846-K 

Tacoma, WA 98411 



Dan Halfwit 



Softkey for.. 



Xevious 

Mindscape 



■ Requirements 

a COPYA 

D Copy II Plus or FID 

This was too easy. 
I 1 1 Use COPYA and the following pokes 



to disable the checksum verify: 

POKE 47405,24 
POKE 47406,96 
POKE 47497,24 
POKE 47498,96 
RUN COPYA 



I 2 I Use Copy II Plus to copy a normal 
DOS over the first 3 tracks of the copy and 
change the boot file to HELLO. 

Optional: 

I 2 I Initialize a disk. 

INIT HELLO 
DELETE HELLO 

Insert the disk with FID and 

BRUNFID 

Copy all files from the COPYA copy of 
XEVIOUS to the initialized disk using the 
wildcard (=) character. 

Softkey for... 



Pirates! 

MicroProse 



■ Requirements 

D Apple Ilgs with 2.x ROM upgrade or Apple 

II W/128K & NMI card 
D Two (ProDOS) formatted double-sided disks 
D BASIC.SYSTEM from any ProDOS System 

Master 
D Copy II Plus (or a ProDOS file copier) 

I didn't make a Cookbook at the end, 
because you may just as well read the whole 
article. It will take all of 3 minutes. 

I played the game for about 8 hours and 
nothing funny happened. It would appear that 
I got all the protection schemes. 



Previously, the bulk of MicroProse games 
were in normal format and the catalog track was 
moved. Sometimes not even that. You would 
only get so far, to then find that another 
protection scheme found you. With Pirates!, 
you don't even start on square one. Some 
format that I am not at all familiar with popped 
up. Fortunately, I found a small hole in it, and 
that was all I needed. 

First, format one of your ProDOS disks 
with the volume name of /PIRATES.SmEl. 
(Don't type the period after the number 1.) 
Then copy BASIC.SYSTEM to that disk, and 
rename it to PIRATES. SYSTEM. Starting to 
get the point? Now, the fiin part. 

For Ilgs users, enter the monitor 
(CALL- 151) and type a # sign at the monitor 
prompt. This will give you the CDA's (Classic 
Desktop Aces.). Put Pirates! in drive 1 and type 
C6O0G at the prompt to boot the disk. Listen 
to the drive. After the ar m of the disk clicks 
ONCE, Press ICJBESC l or the NMI button if 
you have it. 

Select "Visit Monitor" from the Control 
Panel (Hgs users.) At the monitor prompt, type 
A0 A : EA EA EA to kill the " ACCESS ERROR #r ' 
message (didn't that feel good, and on an 
original disk too!) and 9E7 :4C 69 FF to replace 
the command to start ProD OS w ith a mon itor 
bomb. Now, press |QY| and IhetuhhI to 
return to the control panel. Select QUIT. 
Pirates! will go a little more and give you a 
monitor prompt. You now have their funny 
DOS in memory to do your bidding! 

Remove Pirates! and replace it with the 
ProDOS disk you made earlier with the 
renamed BASIC.SYSTEM. Type 20OOG at 
the monitor prompt, and in a few seconds, you 
are in BASIC. You now have a DOS in memory 
that reads normal and abnormal (Pirates!) DOS. 
Use the "-" wildcard command to start Copy 
II Plus (PREFIX /COPYIIPLUS and - 
UTIL. SYSTEM) or a ProDOS file copier and 
copy all the files from botli sides of Pirates over 
to a normal ProDOS disk. Make sure that you 
name the volumes as /PIRATES. SIDE 1 and 
/PIRATES. SIDE2. Now the real fiin part. 

If you boot up what you now have, the 
game will go a little past the title page and give 
you a (believe it or not) "ACCESS ERROR 
#1". But didn't we just kill that? If you search 
the disk, you find one occurrence of this in the 
PIRATES. SYSTEM file, but that isn't it. 
Search for "1# RORRE SSECCA" (ACCESS 
ERROR #1 spelled backwards) and lo and 
behold. This is what we want. We find some 
most curious looking code at $E51. Let's take 
a peek: 
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E51 EOR $B8M,X 




E54 INX 




E55 CPX #$FC 




E57 BCC $0E51 


m 


E59TAX 




E5A BNE $0E61 


(m 


ESC JSR $B863 




E5F BEQ $0E90 


im 


E61 ... ^ ACCESS EmRtl Old bds up 





At first, the above code didn't make much 
sense. It looked hannless enough. But if you 
turn on double hi-res and type E61G, there we 
see the ACCESS ERROR #1. Here's a little 
explanation. $E51-E59 verifies the code at 
$B800 to malK sure that no one tanq>ered with 
it, (It checks $FC bytes.) If it was tampered 
with, it branches to the bomb. If it was okay, 
it executes the code at $B863. It then checks 
die result, and if it was okay, branched to $E9<D. 
No problem. Just patch up the branches a litde 
and it works. Right? 

Wrong. Take sector editor out and search 
for D0 05 20 63 B8 F0 2F or as much as it as you 
can. Change the first 05 to 03, and change the 
F0 to 80. You could NOP the JSR $3863, but it 
isn't necessary. Boot up the disk and... nodiing. 
It locks up, but why? 

Right about now, I was ready to give up, 
but I remembered die code that verified $B8<ZXZ>. 
Was tiiiere one to verify tins as well? (Of course 
there is, but read on.) We trace the file PS3 (the 
one we just edited) up to it's point of origin and 
execution, PIRATES. SYSTEM. Here we find 
some similar code: 

E9B LDA #00 

E9DTAX 

E9E EOR $0800, X 

EAl INX 

EA2 BNE $0E9E {■%} 

EA4 EOR $0900, X 

EA7 INX 

EA8 CPX #BE 

EAA BNE $0EA4 f^j 

EACTAX 

EAO BEQ $0EB9 f+tUj 

EAF . . . hmg fiv etemty 

Here we have some similar code that 
verifies the verify. They're a tidy bunch at 
KQCROPROSE. So all we have to do here is 
make that BEQ a BRA. Use your sector editor 
to find D0 F8 AA F0 0A A9 2C 8D 36 23 or as much 
as you can search for. Change the flrst F0 to 
80. Write it back and you are done! 

Lastly, let's take a look at the catalog. 
Hmmm... We see a bunch of BASIC files. 
Actually, the bulk of the game that you play 
is in BASIC. No wonder it's so slow. 
Somehow, if you could con^ile it, I think it 
would screw up the game something severe. 
And if you are bored, look at the locations in 
the LIFE file. They are the memory locations 
that store your stats. And be sure to look in the 
PICK file. 



A parting note. If you don't use their 
ProDOS file, the game re-boots as soon as it 
starts PIRATES.SYSTEM. Since this is no real 
problem, don't worry about it. Perhaps there 
is a reason other than copy-protection. And for 
Dgs users widi a UNIdrive, the disk access goes 
MUCH faster. 

*IIgs Sofikey for... 



Pirates! Ugs 

MicroProse 



■ Requirements 

D Apple ngs with ROM 01 
D Copy n Plus or a ProDOS file copier 
D Two Formatted UNIdisks (one with 
BASIC.SYSTEM on it) 

The tedinique to crack this was very similar 
to Pirates! Ile/IIc. In fact, with the exception 
of the graphics and sound, the program code 
is near identical. And still in BASIC. 

First, format 2 disks, one of them should 
have the volume name of /PIRATES and should 
have BASIC.SYSTEM on it. Re-name 
BASIC.SYSTEM to PIRATES.SYSTEM. 
Enter the monitor with CALL -151. At the 
monitor (*) prompt, type # to get the CDA 
utilities. 

Boot PIRATES! and listen to t he drive. 
After 1 or 2 clicks, press lOSESC l and select 
"Visit Monitor". Enter "\4C OO 
20\<800. IFFFP" to scan for die JMP (4C00 
20) to start ProDOS. I found mine at $9CC. 
Replace it with 40 69 FF to en ter t he monitor 
instead of starting. Press |ST| and iHKTOMil 
to quit and let the program execute further. In 
a moment, you will see the monitor prompt. 
Remove PIRATES! and insert the disk with the 
re-named BASIC.SYSTEM file on it. Type 
2000G and you wiU have their ProDOS and 
your BASIC. Insert PIRATES! and fype 
CATALOG to verify that this worked. If not, 
try again. 

Now, either start COPY n PLUS with the 
-UTIL. SYSTEM command or start a ProDOS 
file copier. Be careful not to boot another 
ProDOS in the process or what you just did will 
be destroyed. File copy all the files from the 
PIRATES! master disk onto your own blank 
disk. This will take quite a while as there are 
over 10© files to be copied. 

Lastly, whip out ye old block editor and 
search for 8D 20 Bl A2 00 and replace the 8D 20 Bl 
with 60 EA EA. The EA's aren't necessary, but I 
like to be neat. If you don't have a block alitor, 
cqjy the file PS2 from the backup of PIRATES! 
you just made, edit it, and copy it back. Now 
you can enjoy a vastly improved version of 
PIRATES! 

Also, for the novice hacker, here are a few 
tips that I constandy use. This is the first piece 



of ngs software I ever cracked and they were 
most helpful: 

1. A 140K floppy or an 800K UNIdisk is 
a lot of info to search through. Try to determine 
where the protection ISN'T before tiying to find 
where it is. This can be accomplished in many 
ways: 

A. If there are files, determine in what 
sequence that they are loaded. Look for text 
within the startup file to see what files it loads. 
(PS2 was a file loaded from PIRATES 
.SYSTEM). 

B. Plant "bombs" in key locations to see 
how far the code gets, if it ever gets there at 
all. Good ones are 4C 00 06 (re-boot), 40 69 FF 
(enter monitor) and 20 3 A FF (beep). 

2. Things to look for: 20 ED FD (print to 
the screen), AD 00 CO (strobe keyboard), BD 
8C CO (disk access), xx 30 CO (sound), xx 
50 CO (hi-res or double hi-res graphics), and 
XX 51 CO (text screen). 

I hope that these common things to look for 
are of some help to those new to hacking. 

^> Does anyone have any hints on 
how to crack or even copy ALIEN MIND for 
the ngs from PBI. Shelling out $57 for a game 
makes one a Utde uneasy thinking of all the 
nasty things that could happen to it. Kindly add 
it to the Wanted List. Also, if anyone can copy 
TOMAHAWK, or better yet, crack it, please 
let the rest of the uninformed world know of 
your marvel. Please add it to the Wanted List 
too. 



Brian A Troha 



First of all I would like to say to the 
following people: 

Jack R. Nissel (COMPUTIST #56, page 20): 
Realm of Inqmssibility IX)ES work on the Ilgs, 
it's EA's protection routine that does not. See 
COMPUTIST #50, page 20 and also 
COMPUTIST #49, page 16 for information on 
how this is done. A salesman friend has asked 
me to crack several EA programs for him 
because a customer couldn't get them to run on 
a ngs. However, the cracked versions run just 
fine. Keep in mind: there is a second disk check 
at $569 (and $5F8 or $5FE) that should be 
looked into. Some of the EA programs need the 
JMP $569 to shut the disk drive off at the end 
of a disk read, so I edit the calls to $5F8 (or 
$5FE). 

Stephen J. Scalia (COMPUTIST #57, page 
27): It's too bad you feel your subscription 
wasn't as informative as you were looking for. 
I started my subscription with COMPUTIST 
#6, at which time I only knew BASIC 
programing skills and didn't know anything 
about cracking software. I still remember the 
excitement I felt when I cracked my first 
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program ALL BY MYSELF! It was PACMAN 
(and DIG DUG at the same time) and I used 
DEMUFFIN plus. Then I thought what I had 
done was simply tried one person's steps for 
another program, with NO REAL effort on my 
part. Since then, I have learned so many 
diiferait steps that I can adapt to most protection 
schemes to overcome them. Now I can write 
those nifty articles I used to read and think ' 'Boy 
this guy is really smart, I wish I could do that!" 

That was about 4 years ago, it has taken 
a lot of work to get where I am today. Although 
I don't think you (Stephen J. Scalia) will ever 
end up reading this, but I think COMPUTIST 
will give each reader exactly what they put into 
it. If you really want to learn about disk 
protection read ALL the articles making sure 
you try to understand the longer ones as they 
have lots of information in them. I have learned 
so much ftom reading COMPUTIST (and of 
course other mags), I am glad I'm able to return 
the favor and send in articles for other readers 
to learn from. 

Now on to the softkeys: 

Fix for EDD 4 

For some odd reason there is a ' 'lone byte' ' 
that seems to affect the way EDD 4 runs on a 
ngs. Although I have not used EDD 4 in 2 or 
3 years (softkeys do a much better job!) I was 
able to find the bad byte. To fix your copy of 
EDD 4 try this: 

CAU-151 

BUMU) EDD 4 or what ever you called it 

tJMJMi 

Write down the bytes found at $AA61 & 
$AA60 together and at $AA73 & $AA72 
together in that order. These are the length and 
starting address for binary files under DOS 3.3 
only. Now type: 

1F4E:EA was 02 

BSAVE EDD 4,A$im, LSyyyy 

Where xxxx is the two byte hex number 
you found at $AA73 & $AA72, and yyyy is the 
number from $AA61 & $AA60. 

That should take care of any problems 
people are having with EDD 4 and my article 
from COMPUTIST #49. 

*Ugs SofOcey for... 



Softswitch 

Roger Wagner 



■ Requirements 

D Apple ngs 512K 
D 3'/4" disk copier 
mw disk block editor 

The Softswitch (SS) program put out by 
Roger Wagner Publishing Inc (RWP) could be 
a very useftil program if you worked with many 



non-IIgs specific programs. The program 
allows you capture iq> to three programs in your 
ngs's extra memory. Although I have not used 
the program that much, I could see where it 
might come in handy. However I found a few 
things about the program I didn't like, and one 
thing that is FLAT OUT WRONG! 

First the program is supposed to be a classic 
desk accessory (CDA) that can be accessed 
from flie control panel. RWP did not follow the 
correct format for CDAs, a CDA is type $B8 
(not type $B6) and should be found in the 
DESK.ACCS subdirectory and not in the 
TOOL.SETUP subdirectory. 

Lastly the program is copy protected, but 
in a form that must be illegal in some way, if 
it's not illegal it should be! The program disk 
has two unformatted tracks, leaving twenly-four 
blocks unusable, but that's not that bad. The 
real problem occurs when the disk protection 
passes! The program proceeds to alter a byte 
in the BATTERY BACKED UP RAM (BBR). 
RWP has NO RIGHT to physically alter 
anything in my computer that would not be 
changed back when the program is exited. The 
byte at E1/03BB is changed from a FF to a FE, 
then the program checks for it like this: 

A9 FB 00 LDA #$00FB i2C0+fB = M 

DA PHX 

48 PHA 

A2 03 0C LDX //$0C03 Tod call ±30C, read a bpfim 

BBR 
22 0000 

El JSL E10000 Tool locator call 

68 PLA 

29 03 00 AND #$0003 

4A LSR 

F0 02 BEQ +02 Never taken 

90 43 BCC +43 Clear carry = pass 

Since the Branch on E(^ual is never taken, 
I changed it to EA 18 (NOP and CLC) so the next 
branch is always taken. Let them mess up their 
own computers if they want, but leave mine 
alone! When Apple Inc. reserved this memory 
I hardly think they reserved it for RWP. What 
if lOO people wrote programs that did this? 
This type of protection only breeds 
incompatiblity down the line. Well I did fmd 
a way around this protection and a way to 
change your computer back to it's original state. 
To unprotect the ffle "TOOL.SETUP.2" make 
the following block edit (on a copy only): 

Block Byte(s) From To 



$111 $1C7 



F0 02 



EA18 



Using the book ' 'Inside the Apple Ilgs' ' by 
Gary Bond I was able to look up all the values 
in the BBR and check for the altered byte. The 
book also gives the tool call number for reading 
and writing to the BBR. There is also a call that 
sets the BBR checksum if you change one of 
the bytes directly. So I searched the disk for 
each of these and found both parts of the 



protection, the part that changes the byte and 
the second part that checks for it. If you want 
your computer's BBR in it's original state enter 
the following (the back-slashes are very 
important): 

\04 00 00 FF 00 FB 0B 03\U 

This is a tool call to WriteBParam from the 
monitor, this call changes the byte back and 
updates the four byte checksum of the BBR. 
Now your Ilgs should have the BBR in it's 
original state and SS should stiU work. 

This is an INCOMPLETE softkey, the 
install feature will not work on a copy of the 
Softswitch disk without the error, if anyone has 
the fix for that part of SS please let us know 
about it by writing in. Although I had this 
incomplete crack about a year ago I didn't want 
to send it in unless I had the whole thing. Well 
I have don't have enough time to work with it 
so I am asking for help from some of the other 
readers that have this program. 

*ngs Softkey for... 



Mavis Beacon Teaches Typing 

Software Toolworks 



■ Requirements 

D 512K Apple Hgs 
D3'/i" disk copier 
D 3'^" disk editor 
n 2 blank disks 

Mavis Beacon Teaches Typing (MBTT) is 
a typing tutor with a very neat race car typing 
game. The program comes on two 3Vi" disk 
with the program disk having an unformatted 
track (track $4F, side 2) which leaves blocks 
$63A through $63F unusable. Below I will 
explain the Qong) way I tracked everything 
down. 

First I started by making a copy of both 
disks using Copy n Plus v8. The program disk 
gave read errors for blocks $63A through $63F, 
while the data disk would copy without any 
errors. Going to the 3'/^" bitcopy portion of 
Copy n Plus I used the sector editor to scan 
the disk for 22 AS 00 El 22 which is the code for 
a ProDOS 16 block read. I found this string 
once on block $3E7. Once I located this code 
I checked it out and found it gets some 
information, makes the block read, stores a 
value at $A15, then remmed. 

I traced back to the first RTL (6B) before 
the code and changed the three bytes after that 
to 68 FA 00; which is PLA, PLX, BRK (this is 
what I call hitting the BRAKES). I wrote the 
block back to the disk a nd bo oted it, when the 
program crashes (press |ST| to get to the text 
page/mode) you can see where the program 
jumped from. The Accumulator will hold the 
address (less the length of the instruction) and 



November 



COMPUTIST iCei 



9 



the X-register (lo byte) will hold the memory 
block. 

Using this method it's easy to tell the call 
was made from $03/03EE. When checking this 
new code you wiU notice the following things: 
The routine runs from $03/03AO thru 
$03/04B9. The call made to $03/D5FB (made 
once) is to a routine that gets the device number 
to use in checking for the bad blocks. The calls 
made to $03/D5BB (made three times) is to the 
actual block read routines. After each call is 
something like (found on block $37F): 

LOA 0A15 

CMP #0000 No error (eiiter device mmber or Mod read) 

BEQ CONTINUE 

LDA #0000 Load AccmwiAfiiiled value 

BRL FAILED 

CONTDSfUE code 



Load Accm with passed value 

This is vikre Ae 'BRL TABID' comes lo 



LDA #0001 

TAY 

CLC 

ADC #00F7 

TCS 

TYA 

PLD 

RTL Fmdly return to sender 

I made the following changes: 

Block Byte(s) From To 



$37F J2A 


22 


AF 


J33 


C9 00 00F0 06 


EAEAEAEAEA 




A9 00 


A9 01 


$7B 


22 


AF 


$84 


C9 0000F0 06 


EA EA EA EA EA 




A9 00 


A9 01 


$A9 


22 


AF 


$B2 


C9 00 00D0 05 


EAEAEAEAEA 




A900 


A9 01 


m 


22 


AF 


$DF 


C9 00 00 F0 05 


EAEAEAEAEA 




A9 00 00 80 03 


EAEAEAEAEA 



This works fine (producing a cracked 
version), but I thought there was a better way 
using less edits. Again applying the BRAKE 
trick I was able to back-trace the protection one 
more step and came up with the following code 
at $03/6C8E thru $03/6CCl: 



6C8E:0B 
6C8F:3B 
6C90:38 
6C91:E9FB00 
6C94:5B 
6C95:69F6 00 
6C98:1B 
6C99:F4 3A06 

6C9C:F4 0100 
6C9F:22A0 03 03 

6CA3:7A 
6CA4:7A 



PHD 

TSC 

SEC 

SBC #00FB 

TCS 

ADC #00F6 

TCS 

PEA 063A first bad IM to look 

jbr 
PEA 0001 
JSL 0303A0 Call to the code 

desctibed obave 
PLY 
PLY 



6CA5:A8 
6CA6:D012 

6CA8:F417 00 
6CAB:F4 0100 
6CAE:F4C5 64 
6CB1:22 4C3A04 

6CB5:7A 
6CB6:7A 
6CB7:7A 
6CB8:80DF 

6CBA:7B 

6CBC:18 

6CBD:69FB00 

6CBF:1B 

6CC0:2B 

6CC1:6B 



TAY 

BNE 6CBA(+12)AforaTO,rtoi 

cmArm 
PEA 0017 
PEA 0001 
PEA 64C5 
JSL 043A4C Goto insert master 

routine 
PLY 
PLY 
PLY 
BRA SC99 (-21) Go bad and do 

died again 
TDC Must be an original 
CLC 

ADC #00FB 
TCS 
PLD 
RTL Return to sender 



*ngs Softkey for... 



To bypass this step I changed the JSL 
$03/03AO to LDA $03/03AO and the BNE 
$6CBA to BRA $6CBA. The edits to the disk 



Block Byte(s) From 



To 



$363 



$93 
$9A 



22 



AF 



The above edit will produce a completely 
cracked version of MBTT as did the first edit 
I showed. The routine at $03/6C8E seemed 
very short and didn't return any special values 
so I tried the BRAKE trick one more time and 
was rewarded with the following (at 
$04/957C): 



957C;7A 
957D:8E79 09 
9580:80 77 09 
9583:22 8E6C03 

9587:F4 00 00 



PLY 

STX 0979 

STA 0977 

JSL 036C8E Goto Ae start ofAe 

protec&m 
PEA 0000 



958A:22F16B03 JSL 036BF1 

There you have it, three different ways to 
crack MBTT at three different levels. Once 
again this is an example that shows -there are 
many ways to do the same thing. To softkey 
MBTT simply follow these easy steps: 

I 1 I Make copies of both disks (ignore 
errors on blocks $63A-$63F on the program 
disk) 

I 2 I Make the following change to the 
copied program disk: 

Block Byte(s) From To 



$4B9 $197 



22 



AF 



NOTE: You could also apply the other 
edits, but they are not needed. 

I 3 I Write the block back to the copy. 
Store the originals in a safe place. 

Optional: Upload the program to a hard 
drive. 



Magical Myths 

Unicom Inc. 



■ Requirements 

D 768K Apple Hgs 
n SVi" disk copier 
D 3 'A "disk editor 
D Two blanks 3V4" disks 

Magical Myths (MM) is an educational 
program that teaches Greek mythology along 
with teaching basic reading and reading 
comprehension skills. The program makes use 
of limited speech and good grai^cs with mouse 
control. The program comes on two VA" disks 
and uses nibble counting (on tracks $20 and 
$21) on the program disk for copy protection. 
Magical myths is published by the same 
company that puts out Aesop's Fables and uses 
almost Ae exact same protection routine. Like 
the other Unicom program if you search for A2 
20 A001 you would find the copy protection. The 
code is on block $1EE and it looks like: 



14B:E2 30 
14D:A2 21 
14F:A001 
151:20 3F6A 
154:B0 3B 
156:E0B0 
158:98 
159:E91D 
15B:90 2C 
15D:E0 78 
15F:98 
160:E91E 
162:B0 29 
164:A2 20 
166:A0 01 
168:20 3F6A 
16B:B0 24 
16D:E0 40 
16F:98 
170:E91F 
172:9015 
174:E008 
176:98 
177:E9 20 
179:8012 
17B:A9 00 
17D:48 

17E:22 0A6BI 
182:A9 00 
184 :EB 
185:68 
186:28 
187:AB 
188:66 



SEP mi\^Acam 
LDX #2irRicibl2/ 
LDY monadem 
JSR ikl^Qiedjoriteorigiivi 
BCS 191 {^l^) On error goto m 
CPX #B0 
TYA 

SBC mCmparetoWm 
BCC 189(+2C)r(wtow.',j(«oi»9 
CPX #78 
TYA 

SBC mOm^aretoim 
BCS 180(+29)r<w««W,|o(o;«D 
LDX mJradm 
LDY #01 on side one 
JSR iMfChed fur oripnd ■ 
BCS 191 {+ZA) On error goto 191 
CPX #40 
TYA 

SBC #1F Compare to IF4@ 
BCC m(+li) Too low?, goto m 
CPX #08 
TYA 

SBC mCmparetoimS 
BCS m (+12) Too high?, goto m 
LDA mSverydrng passed 
PHA 
' JSL emm Print ?IIASE WATT 
LDA #00 
XBA 
PLA 
PLP 
PLB 

RTL Return U) sender 
"Fail code starts here" 
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coMPunsT mi 



Wovwnbi«| 



If you change the LDX (i^l (A2 21) at$14D 
to BRA $17B (80 2C) then MM no longer checks 
for the original and continues to load. The only 
tfaiqg left is to make the change permanent. Try 
these easy steps: 

rr~| Copy the 3%" disk 

I I I Make the following edits to the copy: 

Block Byte(s) From To 



$1EE $14D A2 21 80 2C 


1 3 1 Write the block back the copv. 
*IIgs SoJOey for... 


Tales from the Arabian Nights 

Unicom Inc. 



■ Requirements 

D 768K Apple Hgs 
nVA" disk copier 
n3V4" disk editor 
D Two blank 3'^" disks 

Tales From the Arabian Nights (TAN) is 
an educational program that teaches old tales 
from the middle east along with teaching basic 
reading and reading comprehension skills. The 
program makes use of limited speech and nice 
graphics with mouse control. The program 
comes on two ZVi" disks and uses nibble 
counting (on tracks $2<Z> and $21) on the 
program disk for copy protection. TAN is 
published by the same company that puts out 
Aesop's Fables and Magical Myths and also 
uses the same protection routine. Like the other 
two Unicom programs, if you search for A2 20 
A0 01 you would find the copy protection. The 
code is on block $553 and it looks like: 

1BB:E2 30 %l'? mmkam 

1BD:A2 21 LDX #21 Tract J27 

1BF:A0 01 m mm^m 

ICl : 20 AB 6A JSR 6AAB CktAjorihe origM 

1C4:B0 SB BCS IFF (+3B) On emrgoto IFF 

1C6:E0B0 CPX #B0 

1C8:98 TYA 

1(» : E9 ID SBC #1D Con^e to IDBO 

1CB:90 2C BCX; 1F9 (+2C) Too low?, goto m 

1CD:E0 78 CPX #78 

1CF:98 TYA 

1D0:E91E SBC #lEGm(w«toi£78 

1D2 : B0 29 BCS IFD (+29) Too high?, goto IFD 

1D4:A2 20 LDX #20 Ml C0 

1D6:A0 01 m mi on side me 

1D8 : 20 AB 6A JSR 6AAB Oied^ original 

IDB : B0 24 BCS IFF (+24) On error goto IFF 

1DD:E0 40 CPX #40 

IDF: 98 TYA 

1E0:E91F SBC #lFai«¥wreto;f# 

1E2:90 15 BCC 1F9 (+15) Too low?, goto 1F9 

1E4:E008 CPX #08 

1E6:98 TYA 



1E7:E9 20 


SBC m Compare to 2m 


1E9:B012 


BCS m{*n)Toohigh?, goto IFD 


1EB:A9 00 


LDA mEver^g passed 


1ED:48 


PHA 


1EE:22 76 6B00 


JSL amiiPrinf PLEASE WATT 


1F2:A9 00 


LDA #00 


1F4:EB 


XBA 


1F5:68 


PLA 


1F6:28 


PLP 


1F7:AB 


PLB 


1F8:6B 


RTL Return to sender 




"FtH code is here" 



If you change the LDX #21 (A2 21) at 
$1BD to BRA $1EB (80 2C) then TAN no 
longer checks for the original and continues to 
load. The only thing left is to make the change 
permanent. Try these easy steps: 

m Copy the 3%" disk. 



I 2 I Edit the copy. 
Block Byte(s) From 



To 



$553 $1BD A2 21 



80 2C 



I 3 I Write the block back the copy. 
*ngs Softkeyfor... 



King's Quest I & n 

Sierra On Line 



■ Requirements 

D 512K Apple Dgs 
n 3V4" disk copier 
D 3'/4" disk editor with search ability 

King's Quest I and n (KQ) have been re- 
released in a Hgs format, with the same type 
of cartoon graphics as the 128K Apple n 
versions. It is sad that Sierra has overlooked 
the potential of the Ilgs, they should have put 
some effort into the gr^hics. Well, to continue, 
the protection is the same as on Space Quest 
and Leisure Suit Larry. The program comes on 
two 3 "A " disk, with both disks having an error 
over block $634. After checking the code on 
both KQ disks, and that of the other two Sierra 
programs I found a common section of code 
(along with the edit to crack them). All four 
disks have this same code (on the disk it looks 
like): 



22 00 0000 


JSL 000000 


C9 0100 


CMP 0001 


F0 04 


BEQ (+4) 


22 00 00 00 


JSL 000000 


22 00 00 00 


JSL 000000 "22 Mm be Aged to ff 


AE00 00 


LDX 0000 


AD 00 00 


LDA 0000 


DA 


PHX 


48 


PHA 



These bytes can be found on block $A0 
for KQl. The patch makes a cracked copy. 



However when the patch is used (on block 
$2ED) for KQ2, the program would load about 
8<Z>% then bomb into the monitor. Now you 
must go back and trace the actual block read 
code and look for some type of flag. After 
searching for 34 06(the number of the bad block) 
I found it twice on block $2C4. Checking this 
code revealed two values (00 02 27 00) are stored 
in consecutive memory. The value 0027 is the 
code returned for a block read error by the 
protocol converter and ProDOS 16. So 
searching for C9 27 would reveal the this ' 'check 
of the disk check" on block $267. If the 02 27 
wasn't found then a JSL was made to some 
subroutine, changing this to a LDA results in 
a cracked version of KQ2!. 

If you use Copy n Plus v8 to search for 
00 F0 04 22 00 00 00 22, when the sequence is 
found, the cursor will be on the byte die needs 
to be changed. The same exact sequence is on 
the four (4) forementioned programs and the 
same change will work for each, however 
King's Quest n does require an addition pateh. 
When checking a copy of Police Quest (also by 
Sierra) I cound not find the above code or any 
protection routine for that matter. The softkey 
for both KQ is as follows: 



1 1 I Make a copy of all the disks, ignore 
errors on block $634. 

I 2 I Make the following change (on the 
copy of disk one only): 

For King's Quest - Quest for the Crown: 



Block Byte(s) From 



To 



$A0 $BB 



22 



AF 



For King's Quest n 
Throne: 

Block Byte(s) From 



Romancing the 



To 



$267 $166 
$2ED $BF 



22 
22 



AF 
AF 



I 3 I Write the block back to the copy. 

Optional: Upload the whole program to a 
hard disk. Store the Original in a safe place. 

Softkeyfor... 



Defender of the Crown 

Cinemaware Inc. 



■ Requirements 

D 768K Apple Hgs 
D 3^4" disk copier 
D 3'^" disk editor 

Defender of the Crown (DOTC) is a 
GREAT new program from Cinemaware. This 
is the first program in a whole line of ' 'Playable 
Movies" (Cinemaware even calls the disks 
"reels") ported from the Amiga and the Mac. 
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While these programs are memoiy hungry 
due to the amount of graphics and sound used, 
these new programs set a new level of quality 
and hopefiiUy a new standard for the Ugs. The 
object of the game in DOTC is to gain control 
of the whole region by waging war in the eleven 
hundreds. DOTC does live up to it's reputation 
with great graphics and music, the game also 
uses the mouse for control which makes for easy 
playablity. 

The program comes on two 3 '/4 " disks and 
uses nibble counting on tracks $20 and $21 of 
disk/reel one. So again, we encounter that same 
"old" comercial disk protection scheme. If you 
get out your disk searching utility and search 
for A2 20 A0 01 or A2 21 A0 01 you will find the 
offending code (on block $258). The code 
should look like this (as it is on the disk): 



03:F4 00 00 


PEA 0000 


06:F4 0000 


PEA 0000 


09:A2 0C22 


LDX #220C 


0C:22 0000E1 


JSL E10000 


10:68 


PLA 


11:9CE117 


STZ 17E1 Store apass value in diejlag 


14:20 E3 17 


JSR llEZ Go to Ae protection roiuine 


17:ADE117 


LDA mi Load the flag 


1A:F0 03 


BEQ IF (+03) If zero M continue 


1C:4C6417 


JMP 1764 Goto mmUASm mg 


1F:22 72 9C00 


JSL 009C72 


23:4C2618 


JMP 182i Go to Ae start of Ae program 


26:0000 


0000 m is mivhin loaded in 


28:08 


PHP Start ofAe protection routine 


29:E2 30 


SEP #30 SbitAcaumdator 


2B:A2 20 


LDX #20 Tradm 


2D:A0 01 


LDY #01 


2F;20FF17 


JSR n?? Count Aem up 


32:B0 0B 


BCS 3F(+0B) carry i«»=^iW 


34:A2 21 


LDX #2irracikJ2J 


36:A0 01 


LDY #01 


38:20 FF 17 


JSR m? Com them up 


3B:B0 02 


BCS 3?(+(i2)Carryset=fiuled 


3D: 28 


PLP 


3E:60 


RTS Setum to sender 


3F:EEE117 


INC UEl Failed so mess up Ae flag 


42:28 


PLP 


43:60 


RTS And return to sender 


44:8E1E18 


STX ISIE Start of 'Count Aem up' 


47:8C1F18 


STY 181F 


4A:5A 


PHY 


4B:DA 


PHX Push (red mmber 


4C:F4 00 00 


PEA 0000 


4F:F4 2118 


PEA mi Push more data. 


52:22 8F9C00 


JSL 009C8F To actual count routine. 


56:8D2018 


STA ISli Store returned value 


59:68 


PU 


5A:68 


PLA 


5B:68 


PLA 


5C:68 


PLA 


5D:68 


PLA 


5E:68 


PLA PuUall extra values 


5F:AD2018 


LDA lS2i Gel Ae returned value 


62:60 


RTS Return to sender 



This one seems real easy to crack, just diink 
about it. First the code stores a zero in the flag 
and goes to the nibble count, then when it 
returns checks the flag for a zero. If you change 
the JSR (20) at 14 to a LDA (AD) the code stores 
a zero in the flag, loads a value and then checks 
the flag for a zero! You could also change the 
BEQ (F0) at 1 A to a BRA (80) just for the sake 
of completeness, although it's NOT needed. If 
for some reason you cannot find the above code 
on block $258 you could search your disk for 
9CE1 1720 E317ADE1 17and change the 20 to AD. 
To crack Defender of the Crown follow these 
easy steps: 

I 1 I Make copies of both DOTC disks. 



I 2 I Make the following edits on a copy of 



disk 1. 



Block Byte(s) From 



To 



$258 $14 



20 



AD 



I 3 I Write the block back to the disk. 

Optional: Upload the whole program to a 
hard disk. 



Softkey for... 



Adventures ofSinbad 



Unicom Inc. 



■ Requirements 

D 768K Apple Hgs 
UVA" disk copier 
D 3V4" disk editor 
D Two blanks ZVi" disks 

Adventures of Sinbad (AOS) is an 
educational program that uses Sinbad's 
adventures to teach basic reading and reading 
comprehension skills. The program comes on 
two 3'/^" disks and uses nibble counting (on 
tracks $20 and $21) on the program disk for 
copy protection. Like the other Unicom 
program if you search forA221A001you would 
find the copy protection. The actual disassembly 
is so close to other Unicom products I didn't 
think it would be worth repeating. 

If you change the LDX #21 (A2 21) at 103 
to BRA 1 3 1 (80 2C) then AOS no longer checks 
for the original and continues to load. The only 
thing left is to make the change permanent. Try 
these easy steps: 

m Copy the 3% "disk. 



I 2 I Make the following edits to the copy: 



Block Byte(s) From 



To 



$47A $103 A2 21 



80 2C 



I 3 I Write the block back the copy. 



Edward Teach 



While I've got your attention, I've got 
something to say. In issue #56 (page 29) the 
RDEXed states that there are about 6000 
subscribers to COMPUTIST. My question is. 
What are the rest of you doing? I have been a 
subscriber since last Sqitember. In the past year 
I have submitted several articles. My first article 
was one entire page on how to find a jump to 
$C600. It wasn't the best work that I have ever 
done, but at least I contributed. 

But what really bothers me, are the people 
who give 38 softkeys by saying change byte A 
to B and don't give any indication how they 
found what to change. If you want to know how 
to write, look at the articles by Brian Troha, 
Jim Hart and Charles Taylor. Even on the 
simple cracks they aU still found something 
"extra" to say about the disk. 

I also got a friend to subscribe and he got 
another friend to subscribe. This is why I can't 
understand why we have a MOST WANTED 
LIST. With 6,00O pe<q)le, out there, why can't 
we get together and overcome a few protected 
disks? And boost the number of subscribers in 
the process. I hope I did not offend the regulars, 
and to the other 5000 + it won't matter. . . you 
never write anyway. 

DOUBLE DOS 

I was working on a softkey for a disk that 
has already appeared in several past issues of 
COMPUTIST. The other cracks all poked an 
18 into $B942 and copied the disk. A few sector 
edits later the COPY A disk was finished. On 
my version there were 11 different address 
prologues and two different data prologues. 
Simply poking $B942 wasn't going to work. 
My first attempt was to write 11 different 
controllers and at least get a COPYA version 
for experimentation. I did manage to make the 
copy, but a large amount of the code was 'junk' . 
Apparently the disk was encoded. After some 
searching I discovered that the read translate 
table was altered. Copying the copy, using their 
read table, produced a disk with good code that 
died horribly during booting. You have 
probably noticed that there are not 11 
controllers at the end of this article. Filling the 
pages of COMPUTIST with all of these did not 
seem to be the best way to present my program. 

While trying to get around this problem I 
remembered several other items that I have 
worked on. (Broderbund and Electronic Arts 
releases). These disks are all protected in the 
same way. A table of header bytes is 
constructed then when a "read" is performed 
the headers are located in the table and placed 
in DOS. Using this theory all I had to do 
(ALL?) was rewrite the DOS read routine, 
construct header tables and place the header 
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infonnation in the new read code. The premise 
of the code is to read drive 1 with the protected 
DOS and drive 2 with DOS 3.3. This is my first 
attempt at writing assembly code, so if it 
appears a bit cryptic, bear with me. The heart 
of the code is DOUBLE.OBJ: 



8095 



JMP $809A 

CLC 

60 



junp to new read 



8000: 


LDA #$18 


POKE normal 


8002: 


STA $8989 


DOS to 


8005: 


STA $8992 


Ignore 


8008: 


STA $899C 


errors. 


800B: 


LDA #$60 




800D: 


STA $898A 




8010: 


STA $8993 




8013: 


STA $8990 




8016: 


LDX #$00 


Move $8944 


8018: 


LDA $8944, X to 


801B: 


STA $809A,X $809A 


801E: 


INX 




801F: 


CPX #$5C 




8021: 


8NE $8018 




8023: 


JMP $8055 


Jump to next move 


8026: 


STY $9000 


StoreX,Y,A 


8029: 


STA $9001 




802C: 


STX $9002 




802F: 


LDA $35 


Get drive # 


8031: 


AND #$80 


turn off bits 


8033: 


8MI $8052 


OR=l?/then jump 


8035: 


LDA #$D5 




8037: 


STA $88E7 


store normal 


803A: 


STA $80AB 


values in 


803D: 


LDA #$AA 


DOS 


803F: 


STA $88F1 




8042: 


STA $8085 




8045: 


LDA #$96 


♦ DOS* 


8047: 


STA $80C0 


* DIVERTER * 


804A: 


LDA #$AD 




804C: 


STA $88FC 




804F: 


JMP $808C 


normal read 


8052: 


JMP $8065 


protected read 


8055: 


LDX #$00 




8057: 


LDA $8026, X Move code from 


805A: 


STA $8944, X $8026 


805D: 


INX 




805E: 


CPX #$30 


to 


8060: 


BNE $8057 


$8944 


8062: 


NOP 




8063: 


NOP 




8064: 


RTS 




8065: 


LDX $0478 


get track number 


8068: 


LDA $80F6,X (05) table 1 


806B: 


STA $80A8 


new read code 


806E: 


LDA $811F,X (AA) table 2 


8071: 


STA $8085 


new read code 


8074: 


LDA $8148, X (96) table 3 


8077: 


STA $80C0 


new read code 


807A: 


LDA $8171, X (05) table 4 


807D: 


STA $B7E7 


normal DOS 


8080: 


LDA $819A,X (AA) table 5 


8083: 


STA $88F1 


normal DOS 


8086: 


LDA$81C3,X (AD) table 6 


8089: 


STA $B8FC 


normal DOS 


808C: 


LOY $9000 


restore Y 


808F: 


LDA $9001 


restore A 


8092: 


LDX $9002 


restore X 



This code modifies the normal DOS read 
routine ($B944-$B99F) then relocates it to 
$8<Z>9A. Next the diverter section is moved 
(fi-om $8026-$8052) to replace the $B944 
code. Finally six tables are created (or at least 
identified) that will hold the header information. 
Now when DOS tries to read the disk our 
diverter will determine the drive being accessed 
and route the code to either the 'normal read' 
or the 'protected' read. The new $B944 code 
saves ^1 the registers, and reads memory 
location $35. TTie current drive number is stored 
as the high bit of that memory location. If the 
bit is not set (1) then drive one was the last 
accessed, if set (O) then drive two was the last 
disk accessed. This would appear to be 
backwards. (1 = not set, O = set). Anyway, 
the code either jumps to the read table code at 
$8065, or pokes the normal 
'D5AA96/D5AAAD' into DOS and then jumps 
to our relocated read routine. 

Just in case I lost the beginners, what all 
this means is the code' will now read whatever 
headers you tell it to on drive one (D4AA96 
for example, or even 9796EB). DOUBLE DOS 
can handle up to eighty different headers on a 
5.25' disk. Also, if you had any trouble writing 
controllers, now the simplist controller will 
function without problem. No more trying to 
write controllers that read one track with one 
header and the next track with a different 
header. The tables relate to the six header bytes: 

Table* Byte Start of Table 



1 


D5 


$80F6 


2 


AA 


$811F 


3 


96 


$8148 


4 


D5 


$8171 


5 


AA 


$819A 


6 


AD 


$81C3 



Each table is forty bytes long to accomodate 
40 tracks per disk. If the disk has only 35 tracks 
the program will still function. It just ignores 
the last few tracks. 

The Applesoft part of Double DOS serves 
as an easy method to input the tables. The 
majority of the code is for input. The code 
builds six strings J$(X) (X= 1 to 6), converts 
the strings to hex bytes and pokes them into 
memory. I tried to make this as painless as 
possible. However, writing a full screen editor 
is less than fiin. Other than the four arrow keys 
for cursor movement the on ly other keys that 
you need to know are lESCl to exit the editor, 
and ISWl to write the new tables to memory. 
After entering all the tables (you can s kip the 
ones you don't need) and pressing ISWj , drive 
one will no longer be able to read DOS 3.3. 
Any program that you need to load MUST be 
loaded from drive two. Do not forget to remove 
the disk from drive two. A write protect tab is 



also a good idea. 

As a final note we need to modify SUPER 
lOB 1 .5 so only 5 tracks are read at one time. 
Reading more overwrites the code we just 
entered. Do the following to the SUPER lOB: 

LOAD SUPER lOB 1.5 

10075 IF PEEK(47428) = 140 THEN UB = 

110: GOTO 10085 
10080 MB s 151 
10085 HOME: DOS - 16: HX$ = "00010203040 

50607080910111213141516171819M1B1C 

1D1E1F202U2" 
SAVE SUPER lOB 1.5 

This change will peek in memory to see if 
Double DOS has been installed. If it has then 
the MB parameter is lowered to copy only five 
tracks, if not then the normal seven tracks will 
be copied as usual. This change is completely 
transparent to you when running the program 
and once entered will automatically handle my 
program when ever it is in memory. To find 
the proper bytes to store in the tables you will 
need a pencil, paper and a nibble reader. (I use 
the 'N' fimction of Locksmith 6.0). Nibble read 
track $00 and write down the Address and 
Data prologue bytes. Then repeat the process 
for the entire disk. Now, run Double DOS and 
enter any changes into the correct tables. If, for 
instance, all the first bytes of the Address are 
the normal "D5"'sthen skip tableoneand goon 
to table two, if the second bytes are all "AA"s 
then table three... 

I know that this is a lot to key in, however 
I find it a usefiil tool in deprotecting programs. 

DOUBLE DOS 

10 REM SET UP VARIABLES 

20 DIM H$ (40) 

30 F$(l) = "D5" :F$(2) = "AA" :F$(3) = "96" 

:F$(4) = "D5" :F$(5) = "AA" :F$(6) = "AD" 
40B$(1) = "D5'AA'96" :B$(2) = "D5'AA'96" :B$(3) 

= "D5'AA''96" :8$(4) = "D5'AA'A0" :B$(5) = 

"05'AA'AD" :B$(6)="D5*AA'AD" 
50X=1 

60J$(1) = "D5":J$(3) = "96" :J$(6) = "AD" 
70J$(1)=J$(1)+"D5":IFLEN(J$(1))<80THEN 

70 
80J$(3)=J$(3)+"96": IFLEN(J$(3))<80THEN 

80 
90J$(6)=J$(6) + "AD":IFLEN(J$(6))<80THEN 

90 
100J$(2)=J$(2)+"AA" : IFLEN(J$(2))<80THEN 

100 
110J$(4)=J$(1):J$(5)=J$(2) 
120 POKE 47426,24 

1 30 REM BLOAD DOUBLE . OBJ AND CREATE S I X TABLES 
140 PRINT CHR$ (4) "BLOAD' DOUBLE. OBJ" 
150 CALL 32768 

160 FOR X = 33014 TO 33054: POKE X, 213: NEXT 
170 FOR X = 33055 TO 33095: POKEX,170: NEXT 
180 FOR X = 33096 TO 33136: POKE X, 150: NEXT 
190 FOR X = 33137 TO 33177: POKE X, 213: NEXT 



Noveniber 



COMPUnST #61 



13 




200 FOR X= 33178 TO 33218: POKE X, 170: NEXT 

2 10 FOR X = 33219 TO 33259 : POKE X , 173 : NEXT 

220X = 1 

230 CALL -936 

240 REM SET UP I NPUT SCREEN MASK 

250 VTAB 1 : HTAB 14 : I NVERSE : PR I NT "DOUBLE'DOS' 

260 VTAB 3: HTAB 09: PRINT "WRITTEN'BY'EDHARD' 

TEACH" 
270 VTAB 5: HTAB6: PRINT "00-"'"0A-'""14-* 

280VTAB6: HTAB6: PRINT "01-"'"0B-"'"15-* 

290 VTAB 7: HTAB 6: PRINT "02-*""0C-""' 16-' 

""20-" 
300 VTAB 8: HTAB 6: PRINT "03-"'"0D-*""17-* 

A A A A A 1 11 

310 VTAB 9: HTAB 6: PRINT "04-""'0E-'""18-* 

AAAAAft (I 

320 VTAB 10: HTAB6: PRINT "05-'""0F-""' 19-* 

AAAAA^ H 

330 VTAB 11: HTAB 6: PRINT "06-""'10-'""lA-' 
340 VTAB 12: HTAB6: PRINT "07-""* 11-""' IB-' 

AAAAAr n 

350 VTAB 13: HTAB6: PRINT "08-'""12-*""lC-* 

AAAAAf N 

360 VTAB 14: HTAB6: PRINT "09-""'13-"'"lD-' 

AAAAa^ II 

370VrAB16: HTAB 15: PRINT B$(X) 

380 VTAB 18; HTAB 15: PRINT "TABLE->" X 

390 U = 5: 1 =09 

400 R = 1 

410 FOR Q = 1 TO 10: VTAB U: HTAB I : PRINT MID$ 

(J${X),R,2):U = U + 1:R = R + 2:NEXT 
420U = 5:I = 1+8: IF I < 35 THEN 410 
430 VTAB 20: HTAB 5: PRINT "DO' YOU* WANT' TO' 

CHANGE' THE*" ;: INVERSE : PRINT F$(X): 

NORMAL 
440 PR I NT 

450 PRINT """""""""Y/N*" ; : GET A$ 
460IFA$ = "N"THENX = X + 1: IFX>6THENX=1 
470IFA$ = "Y"THEN510 
480IFA$ = CHR$(23)THEN780 
490 GOTO 370 
500 REM SCREEN EDITOR 
510H = 9:V = 5:C=1:F(X) = 1 
520HTABH: VTAB V: GET A$ 
530 IFA$ = CHR$ (21) AND ((H = 09) OR (H = 17) OR 

(H = 25)OR(H = 33))THENH = H + l:C = C+l: 

GOTO 670 
540 IFA$ = CHR$ (21) AND ((H = 10) OR (H = 18) OR 

(H = 26)0R(H = 34))THENH = H-1:C = C + 19 
550IFA$ = CHR$(21)THENH = H + 8:IFH>34THEN 

H-9'C = C-80 
560IFA$ = CHR$(21)THEN670 
570 IF A$ = CHR$ (08) AND ((H = 10) OR (H = 18) OR 

(H = 26)0R(H = 34))THENH = H-1:C = C-1: 

GOTO 670 
580 IFA$ = CHR$ (08) AND ((H = 09) OR (H = 17) OR 

(H = 25)0R(H = 33))THENH = H+1:C = C-19 
590IFA$ = CHR$(08)THENH = H-8: IFH<09THEN 

H = 33 ' C = C + 79 
600IFA$ = CHR$(08)THEN670 
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610IFA$ = CHR$(11)AND((H = 10)OR(H = 18)OR 

(H = 26)0R(H = 34))THENH = H-1:C = C-1 
620IFA$=CHR$(ll)THENV = V-l:C = C-2: IF 

V<5THENV=14:C = C + 20 
630IFA$ = CHR$(11)THEN670 
640 IFA$ = CHR$ (10) AND ((H= 10) OR (H = 18) OR 

(H = 26)0R(H = 34))THENH = H-1:C = C-1 
650IFA$ = CHR$(10)THENV = V + l:C = C + 2: IF 

V>14THENV = 5:C = C-20 
660IFA$ = CHR$(10)THEN670 
670 I F A$ = CHR$ (08) OR A$ = CHR$ (21) OR A$ = CHR$ 

(10)ORA$ = CHR$(11)THEN730 
680IFA$ = CHR$(27)THEN430 
690 HTAB H : VTAB V: PR I NT A$ 
700IFC=1THENJ$(X)=A$ + RIGHT$(J$(X),LEN 

(J$(X))-1): GOTO 720 
710J$(X)=LEFT$(J$(X),(C-1))+A$ + MID$ 

(J$(X),(C+1)) 
720GOSUB760 
730 GOTO 520 

740X = X+1: IFX>6THENX=1 
750 GOTO 430 
760B = H:N = V 
770 H = B:V = N: RETURN 
780X = 1:R=1:Z = 33014 
790 IF NOT F(X) THEN 950 
800FORP = 1TO40 
810H$(P)=MID$(J$(X),R,2) 
820 R = R + 2 
830 NEXT 

840 REM CONVERT DEC TO HEX 
850 R = 1 

860FORE = 1TO40 

870S$ = LER$(H$(E),1):T$ = RIGHT$(H$(E),1) 
880 I F S$ = > "A" AND S$ < = "F" THEN H = ASC (S$) 

-55: GOTO 900 
890H = VAL(S$) 
900 I F T$ = > "A" AND T$ < = "F" THEN M = ASC (T$) 

-55: GOTO 920 
910M = VAL(T$) 
920 NU = H * 16 + M 
930POKEZ+(E-1),NU 
940 NEXT 

950Z = Z + 41:R=1 
960 VTAB 23: HTAB 5: PRINT "* INSTALLING' TABLE* 

"X 
970X = X+1: IFX<7THEN790 
980 HOtK : PRINT "DRIVE* ONE' WILL' NOW* READ* 
PROTECTED* DOS" : PRINT "DRIVE* THK)* WILL* 
NOrREAD*DOS*3.3" : PRINT"RUN*SUPER*IOB* 
1.5*FR0H*DRIVE*TW0" 
990 END 

Checksums 



10 


- $BADD 


510 


-$BC9A 


20 


- $28C7 


520 


- $6595 


30 


- $3E0A 


530 


- $57A2 


40 


- $CA9A 


540 


- $F603 


50 


- $8D2B 


550 


- $40FF 


60 


- $5371 


560 


- $7436 


70 


- $BA15 


570 


-$A0C7 


80 


- $5378 


580 


- $07D8 


90 


- $AFD2 


590 


- $4A93 
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100 


- $19D0 


600 


- $FE1C 


110 


-$F2C8 


610 


- $50A3 


120 


- $8C74 


620 


- $711A 


130 


- $7EC8 


630 


- $4090 


140 


- $BBED 


640 


-$B36D 


150 


- $AE43 


650 


- $2488 


160 


- $EFE2 


660 


- $F088 


170 


- $0548 


670 


- $FB1C 


180 


- $EA95 


680 


- $6660 


190 


- $19AB 


690 


- $FFC0 


200 


- $807F 


700 


- $F353 


210 


- $354B 


710 


- $C914 


220 


- $188B 


720 


- $59E8 


230 


- $A730 


730 


- $47C2 


240 


- $BA1A 


740 


- $736E 


250 


- $2154 


750 


- $BC5F 


260 


- $40FF 


760 


- $0130 


270 


- $15BF 


770 


- $9088 


280 


- $A684 


780 


- $E3BD 


290 


- $B6A5 


790 


- $3A93 


300 


- $C672 


800 


- $382A 


310 


- $D53A 


810 


- $6551 


320 


- $CB2D 


820 


- $46FB 


330 


- $D96E 


830 


-$5A89 


340 


- $EF17 


840 


- $E84E 


350 


- $FB6F 


850 


-$18ED 


360 


- $8692 


860 


- $9687 


370 


- $8926 


870 


- $7EBA 


380 


- $507D 


880 


- $5FBB 


390 


- $918B 


890 


- $7D2A 


400 


- $BC35 


900 


- $3816 


410 


- $AA28 


910 


- $F059 


420 


- $9E70 


920 


- $4176 


430 


- $7518 


930 


- $836F 


440 


- $8861 


940 


- $FE1D 


450 


- $7007 


950 


- $7739 


460 


-$90D6 


960 


- $6EBF 


470 


- $C2DD 


970 


- $FCE7 


480 


- $1880 


980 


- $631C 


490 


- $59FF 


990 


- $8847 


500 


- $AB89 







D0UBLE.06J 



8000: A9 18 8D 89 89 80 92 89 
8008: 8D9C89A9 608D8AB9 
8010: 8D93B9 8D9DB9A0 00 
8018:8D44 89 9D9A80E8E0 
8020: 5CD0F5 4C55 808C00 
8028:90 8D01908E02 90A5 
8030:35 29 80301DA9D5 8D 
8038:E7 88 8DAB80A9AA8D 
8040:F1B88D85 80A9 96 8D 
8048:C0 80A9AD8DFCB8 4C 
8050:8C80 4C65 80A2 00BD 
8058:26 80 9D44 89E8E0 30 
8060:D0F5EAEA60AE78 04 
8068:6DF680 8DAB80BD1F 
8070:818DB5 80BD48 818D 
8078:C0 80BD71818DE7B7 
8080:8D9A818DF188 8DC3 
8088: 81 8D FC 88 AC 00 90 AD 
8090:0190AE02 904C9A80 
J: 18 600000 



$082F 



$7B71 
$2F71 
$51AF 
$4499 
$29F6 
$0831 
$1AB9 
$335F 
$67BA 
$F8A0 
$6E92 
$4B81 
$D3A3 
$CD4F 
$CFE5 
$6306 
$F780 
$27A8 

Movwnlwr 



Softkey for... 



MatbbJaster 

Davidson and Assoc. 



This disk has had a few softkeys published 
over the last months. None of these would work 
on my disk. My copy had 1 1 different address 
prologues and two different data prologues. My 
first attempt at disk inspection is always to make 
a COPYA version. Making the copy will be alot 
easier if you enter these tables into Double 
DOS: 

Table 1 



00-D5 


0A-DF 


14-D5 


lE-DF 


01-D5 


0B-OF 


15-D5 


IF-DF 


02-D7 


0C-DD 


16-D7 


20-F5 


03-D7 


0D-DD 


17-D7 


21-F5 


04-D5 


0E-DF 


18-DO 


22-F7 


05-D5 


0F-DF 


19-DD 


23-D5 


06-D7 


10-D5 


lA-DF 


24-D5 


07-D7 


11-D5 


IB-DF 


25-D5 


08-DD 


12-D7 


IC-DD 


26-D5 


09-DD 


13-D7 


ID-DD 
Table 3 


27-D5 


00-96 


0A-9E 


14-96 


1E-9E 


01-97 


0B-9F 


15-97 


1F-9F 


02-96 


0C-9E 


16-96 


20-B6 


03-97 


0D-9F 


17-97 


21-87 


04-96 


0E-9E 


18-9E 


22-86 


05-97 


0F-9F 


19-9F 


23-96 


06-96 


10-96 


1A-9E 


24-96 


07-97 


11-97 


1B-9F 


25-96 


08-9E 


12-96 


1C-9E 


26-96 


09-9F 


13-97 


1D-9F 
Table 6 


27-96 


00-AD 


0A-B5 


14-85 


lE-85 


01-AD 


0B-B5 


15-85 


lF-85 


02-AD 


0C-B5 


16-85 


20-85 


03-B5 


0D-B5 


17-85 


21-85 


04-B5 


0E-B5 


18-85 


22-85 


05-B5 


0F-B5 


19-85 


23-AD 


06-B5 


10-B5 


lA-85 


24-AD 


07-B5 


11-B5 


18-85 


25-AD 


08-B5 


12-B5 


lC-85 


26-AO 


09-B5 


13-85 


lD-85 


27-AD 



As an example, these tables tell the read 
routine to read track $OF with DFAA9F-D5AAB5, 
instead of D5AA96-D5AAAD. After the tables have 
been entered, place Super lOB 1.5 in drive 2 
and run it. Then EXEC the simplest controller 
you have (CON.STANDARD). Be sure to 
remove the disk from drive 2. Place a formatted 
blank in drive two, alter the read translate table 
(CALL- 151/ BAD5:03) and copy away. You 
could also try cataloging both drives. The 
Mathblaster will now catalog in drive 1 as will 
the DOS 3.3 in drive 2. The copy does not need 
their DOS. But for the novices it is important 
that you know what a protected DOS looks like. 



From here on I am relying on the softkey from 
Fred Long (COMPUTIST #53). 

Davidson and Assoc, checks their disks 
with the use of "PEEK(40324)". Where this 
shows up in the code we must change the code. 
Reboot and load a normal DOS, then: 

RENAME H[OZ]EI'LO, HEUO 

LOAD HELLO 

POKEie4,32 

POKE33,33 

LIST400 

Change the = to <> and the <> to =. 

P0KE1M,8 

SAVE HELLO 

LOAD M[bz]ATH blaster 

LIST 360 

Change the = to <>. 

LIST400 

Change the = to <> and the <> to = 
SAVE M(oz]ATH BLASTER 

The disk is now COPYAble. Enjoy 

Notes: 

Whoever placed ALGEBLASTER and 
WORD ATTACK on the MOST WANTED 
LIST, try DOUBLE DOS to softkey it. Has 
anyone else noticed that the list is getting long? 
I don't understand why some of the items are 
on the list. Certificate library volume one for 
instance. The softkey in COMPUTIST #43 for 
CERTIFICATE MAKER worked for me. The 
library disks can be copied with COPYA with 
a few changes. 

RUN COPYA 

70 

CALL-151 

B942:18 

3A1:18 

RUN 

The drive will grind over track 21 , but this 
is alright. If the program disk is deprotected 
then the library disks will also work. Next, my 
Wheel of Fortune was NOT protected. I don't 
think that Sharedata uses any protection on their 
disks. The MECC Puzzles and Posters can be 
copied by capturing their RWTS and using the 
SWAP controller. 



Jim Bancroft 



Softkey for... 



Cross Clues 

SRA 



Well I finally got into Cross Clues by SRA. 
You just have to keep on peeling off the layers 
of protection. First the disk format is in DOS 
3.2 with epilog modification. Second all file 
names have 8 control-H's at their ends making 



them impossible to type at the keyboard. Third 
the graphics controller file is encoded on the 
disk and counts on SRA's DOS to do part of 
the decoding. Fourth the usual control-D DOS 
commands are replaced by really strange 
control-D control-various one letter entry 
commands. In combination with the control 
characters appended to the file names, this 
makes really odd disk access routines in the 
BASIC programs. 

This job would not have been done without 
the Senior Prom, the Zap editor from Bag of 
Tricks and the disk utilities of Copy II Plus. 
With all the protection uncovered however, you 
can now survive with just the Copy H Plus 
utilities if you don't mind a lot of extra effort. 

I 1 I Capture the RWTS and use it to copy 
the disk to a normally initialized DOS 3.3 or 
fast DOS disk. The startup program should be 
called "A". I used the Senior Prom and COPY 
B which is on its utility disk for this job. It takes 
approximately 2 minutes to get your normalized 
copy. 



m Use Copy II Plus to "RENAME" the 
"FILES" on the disk. Remove the control 
characters from each name. This will give you 
files A, B, C, and D in BASIC; file G, which 
is the picture of the Sherlock Holmes hat; file 
F which is the ASCII data file; and file E, which 
looks like garbage but is the encoded graphics 
controller file that I'm certain has stopped 
deprotection of this program up until now. 

I 3 I Capture file E in decoded form. 
Obviously the file must be decoded if it is 
operating throughout the program. Since Copy 
II Plus just gave us the address (16384) and 
length (2559) of file E on our normalized disk, 
we simply have to stop program execution get 
normal DOS booted and BSAVE it. 

Again the Senior Prom or the Fingerprint -I- 
printer interface makes this a cinch; but given 
the file' s location in memory, its quite likely 
that a IcSGHESETI to normal DOS should 
allow a clean save. I did not try that however. 
Why take a chance on losing code when you 
have two of the best memory capture devices 
ever made for the Apple. 

I 4 I Normalize the DOS commands and 
the names of files which are called by the 
programs. Check the BASIC lines which do this 
job. They show how putting in protection must 
drive programmers up a wall. The simple job 
of opening, positioning, reading and closing a 
text file becomes a one of kind code set, useless 
on any other disk. While you're altering the 
DOS calls, eliminate the decoding of file E after 
its BLOAD in programs B, C, and D. 
Their command set: 

CTRL-D;CTRL-Q = RUN (used on B, C SO) 
CTRL-D;CTRL-B = BLOAD (used on E & G) 
CTRL-D;CTRL-0 = OPEN (used on F) 
CTRL-D;CTRL-P = POSITION (used on F) 
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CTRL-D;CTRL-R = READ (used on F) 
CTRL-0;CTRL-C = CLOSE (used on F) 

You will notice that before any DOS 
operation, there is a for-next loop which adds 
CHR$(8) to the name of the file to call. That 
is how thsy add the control-H's to the file name. 
You will of course eliminate that loop since you 
have normalized the names. It would be 
impossible to save such names to disk from the 
keyboard. 

In program A: make line 16 REM and 
normalize the command in line 20 

In Program B: make line 10 PRINT 
CHR$(4)"BLOAD E". Do not call the decode 
routine. You will have an already decoded E 
file on your disk. Eliminate the file name loop 
and normalize the DOS commands in lines 108 
and 294. 

In Program C: make line 3 PRINT 
CHR$(4)"BLOAD E":GOTO 10. In line 
1540 and 1 1400 normalize the file names and 
the EKDS commands. In the routine running 
flx)m 13028 to 13040, REM line 13028 to kiU 
the name change loop and alter the DOS 
commands in lines 13030 and 13040. 

In Program D: make line 3 PRINT 
CHR$(4)"BLOAD E":GOTO 10 and change 
the DOS command in line 32020 
A note regarding the decoding of file E: 

File E is BLOADed by file B and also by 
file C and file D. In aU three programs 
immediately after the BLOAD of E there is a 
call to a location inside E which does the 
decoding. The answer is simple take out the 
call. To make life a little more interesting most 
calls within the BASIC programs are done as 
interdependent variables (PI = P2 + 5 etc.) 
After extensive code following within E, I 
found that only the call immediately after the 
BLOAD will execute a decode. There is no 
alternate entry methods used. It was 
unnecessary to place any RTS within file E to 
disable the decode routine. 

Softkey for... 



TbMware 

SRA 



Search the disk for BD 8C C0 10 FB C9 xx D0 
1 (where xx is a strange byte like E7) and replace 
the 01 with ID. What youjust did was bypass the 
check for fiinny sync bytes and branch to the 
check for the normal data header. This set 
contains many nice Science Simulations such 
as The Village Fish Farmer and The Town 
Energy Planner. 

Some notes on Mindscape 

Mindscape uses several different 
protections. Be sure to check COMPUnST #28 
page 22 for some of them but here are a few 
more. 



On their disks using FORTH as the 
operating syston, check track $00, sector $03. 
It contains a jump to reboot make any BNE a 
D0 00 before the reboot (4C 00 C6) in this sector. 
Now read track $00, sector $05 and what you 
find is the code that Spinnaker and Designware 
use all the time on their track $00, sector $3. 
Referring to COMPUTIST #22 page 4 
"deprotecting Stoiymaker" we find that 
changing byte $71 fh>m 02 to 00 eliminates the 
protection. 

On their disks using Dinky DOS changing 
the 4C 00 C6 on track $00, sector $0B to 4C 06 
17 (which appeared a few bytes previous) took 
care of that protection. 

In their LEARNING WELL series 
modifying DOS 3.3 to ignore the first byte of 
the data header (B8E6:29 OO) allowed COPYA 
to handle this set. Then replace their DOS with 
a normal or fast DOS and your all set. 

Their Pascal is simple. Use the Zap editor 
of Bag of Tricks to take block $00 fi'om a 
normal Pascal disk and put it onto a copy of 
their program made with COPYA. This same 
method works for Scholastic's new ProDOS 
protection if you take block $00 from a normal 
ProDOS disk 

Some notes on Scholastic 

speaking of Scholastic they have released 
a version of Newsroom with protection slightly 
different from Springboard's original. On track 
$00, sector $03, change byte $42 from 38 to 
18. On Track $02, sector $0F their are two JSRs 
foUowed by BCS (20241FBCSxxor2027 IFBCS 
XX). They check the ID of the disk. Change them 
to EAEAEAEAEA. Elsewhere, on thedisk, you will 
fmd a disk check (BD 8C C0) which looks for 
some fiinny bytes like E9andF7. make the first 
four BNE's of the sector D0 00 and you're set. 
This routine was on the disks I checked at track 
$12, sector $03 and again at track $17, sector 
$0E, so you should check the entire disk. 

Some notes on Hartley software 

Hartley normally copies by turning off 
error checking (B942: 18) and using COPYA. 
However if an lO error comes up after the DOS 
prompt appears, check your Hello program for 
a call to DOS (up in the 40000's), this checks 
to see if track $23 contains certain code. 
Remove the call and you should be set. The 
Voyage of the Mimi uses this same protection. 

Softkey for... 



Megabots 

Spinaker (UXB) 



that 4001 is actually part of the Hello in 
memory so you should not drop the line since 
that would relocate or lose the attached binary 
code at the end of the Hello. Change the 
CALL4001 to REM4001 and you will not 
create that problem. 

Softkey for... 



Smart Eyes 

Addison Wesley 



Addison Wesley has Smart Eyes which 
contains disk check code (66 BD 8C C0) in a file 
called SMART.OBJ on track $2 1 , sector $03 . 
You must load the accumulator and set the cany 
flag before returning so change the code to 9D 
88 C0 38 60 and you are set. 

Some notes on Prentice Hall 

Prentice Hall has a series of normal format 
software that gives nasty messages when you 
copy it and run it. A disk m^ shows track $05 
sector $03 in use but no file using the sector. 
Byte $52 of the sector has disk access (BD 8C 
C0) code. At byte $61 there is a 4C 66 4B, at byte 
$64 there is a A0 00 DD 88 C0 60, at byte $25 there 
is a BEQ (F0 xx) which lands at byte $64. 
Decreasing the value of xx by 3 will land you 
at byte $61 and you will have passed the disk 
check successftilly. 

Some notes on CAI 

CAI (Computer Academic Ideas) has a 
variety of game show style quiz programs. You 
will find the usual BD 8C C0 followed by many C9 
E7's in their protection. Finally there will be a 
BEQ (F0 XX) to some location. If the code at that 
location is 18 90 3E change it to EA EA EA. If it 
isn't, study the code in front of your location. 
If it is a JMP then change the code at your 
location to the same JMP. Things should then 
work fine. 

Softkey for... 



PES Computer Checkup 



Spinnaker (under the company name UXB) 
has a little adventure game called Megabots. 
Dropping the CALL 4001 in the Hello 
program eliminates the protection check. Notice 



XPS Diagnostics is now PES Computer 
Checkup but the protection remains the same. 
Copy with Locksmith fast back-up ignoring 
errors on track $03 and also on tracks $lD-22. 
They are nibble count and unused tracks. Look 
for 20 47 1 7 on the copy change it to A0 29 A9 0C 
60 . This loads Y with 29 and A with 0C and then 
returns to the protection check caU without 
checking. These values are then stored at $3 A 
and $3B to be used later by code at $1742. The 
Senior Prom told me this and it didn't lie. The 
copy boots much faster without the extensive 
and precise nibble count. 
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Some notes on CTW Series 

In COMPUTIST #28 page 23 there was a 
softkey for Alphabetic Keyboarding by 
Southwestern Publishing. Personally I didn't 
use that method, I used insertion of a pretty long 
routine into normal DOS 3.3 to read the disk. 
What I noticed though, was that my modified 
DOS could read Alphabetic Keyboarding and 
the entire Apple Presents CTW Series (an old 
set of Integer BASIC classics). My guess is that 
the softkey in COMPUTIST for the 
keyboarding set will take care of the CTW set 
too. 

Some notes on Garfield 

In COMPUTIST #55 Jerry Stevens 
softkeyed Create With Garfield Deluxe Edition 
perfectly. Thanks Jerry I lost my notes on that 
one but we did exactly the same thing to exactly 
the same code. You figured out though what 
the heck we were doing. You found the 
translation of the IF to C0 which read the disk. 
For the life of me I had no idea where the 
working value was coming from, but I do know 
what the program did with it. Look at the code 
from $6DD6 to $6DDB. It has done all kinds 
of AND's and OR's then stored the value at 
$6E67. It then compares the final value to $5C. 
If carry is set, it clears, shuts off the drive and 
returns . If cany is clear it sets shuts off the drive 
and returns. The change of 38 to 18 we made 
means no matter what ends up at $6E67 it does 
the same thing. 

Jerry mentioned an unused signature on 
track $23. DLM also publishes a twin program 
called Teddy Bearells of Fun. The protection 
is exactly the same as Jerry described for 
Garfield, but this program uses every sector 
from track $02 on for data; so, its nibble count 
is done with track $23. They obviously format 
hundreds of disks then put the programs onto 
them. Garfield did not overwrite track $22, 
Teddy did. Big, fat, hairy deal! 

Finally let's give credit where credit is due. 
The Create With Garfield softkey by Robert 
Brown in COMPUTIST #44 has been called 
many things, none of which are kind, since it 
was first published. The softkey was brilliant. 
It accomplished with A2 00 60 what took me 36 
EA's . Refer to Mark Harris in COMPUTIST #55 
for a complete list of the sectors you will need 
to work in if you don't want to search. Search 
for 8D 9E B8 . This code stores the epilog byte into 
DOS as Garfield changes from Program disk 
to Data disk. Naturally since your program is 
now the same as the data disk, you don't want 
to do that anymore. You still have to tell the 
program that you did it though. So, 3 bytes in 
front of the 8D 9E B8 put A2 00 60 to load the X- 
register with 00 and return to the caller. 

You are going to have one minor problem 
with your normalized copy. When it is time to 
initialize, if the disk you want to initialize has 



Garfield epilogs, it will not initialize it. Since 
Garfield epilogs are now normal epilogs, that 
means any disk which has been previously 
formatted can not be reinitialized. Solution open 
the drive door until it reads two lO errors (tiiat 
awfiil growling sound) then close the door. The 
10 error sets the carry flag just as if it found 
no epilogs at all, and it initializes the 
"unformatted" disk. 



John E. Wanner 



Playing Tips for... 



Wasteland 

Electronic Arts 



Wasteland is a fascinating role-playing 
adventure game which uses Uzis and Laser 
weapons instead of the usual swords and magic. 
As with many such games, much of the fiin is 
found in exploring the extremely large world 
scenario and solving its puzzles, but much of 
the frustration is in trying to obtain a set of 
survivable characters with enough offensive and 
defensive weaponry to handle nearly anything 
in the game. This tip will help you get the 
strongest armor and most useftil weapons in a 
fairly efficient manner. 

1 . First, there are four sides to the game 
disks. Make several copies of each; especially 
at least 6 copies of disk 2. The fastest way to 
do this is to let the game disk copy one of each 
and then copy each of these sides using a fast 
copy program (like Locksmith Fast Copy.) Be 
sure to have at least 2 copies of side 1 at all 
times and reserve one of diese. Then anytime 
you want to do something foolish (like try for 
the "big bucks" or enter a very difficult area) 
back your characters up to both. Each save only 
takes 10 seconds or so. 

2. Start with the 4 players you get on disk 
until , you know what you want. Those 
characters will survive and you can always add 
skills as you go through the game. 

3. Make your way to the village of Needles, 
in the central part of the map, just across the 
river. Enter from the N and you'll be near a 
police ammo dump. One of your stock 
characters can probably (save off and keep 
trying) disarm the booby traps. (Stay away from 
the old TNT! !) Giet more ammo and explosives. 
Go to the police station, pass the desk sergeant 
and go to the first room on the right. Have a 
character with the appropriate skUls (keep 
trying!) pick the lock, search the right wall for 
the alarm and set it to O. Raid the now disarmed 
armory. Do not mess with the cells in the jail! 
This is fatal.' 

4. Head S to town. You'll have some spare 
weapons and equipment (I found grenades were 
next to useless) and find LeRoy's (2nd building 
East of the edge of town) and sell your extra 



gear. I found it convenient to have uniform 
ammo so I could trade when one person ran 
low, so I stuck with all 9nmi equipment. In any 
case, you may find LeRoy has some useftil 
goodies you can now afford, but always have 
a few extra inventory slots for each character. 

4. Leaving LeRoy's you'U probably be 
confronted with "jerks'; if not, go to the alley 
just W and you certainly will. Kill everyone 
there except the woman. Hire her. Her name 
is Christina and she comes equipped with an 
armor class 5 radiation suit and Uzi. Pick up 
all the goodies you find and sell them back to 
LeRoy. You can repeat this and get 2 non- 
player characters (NPC) named Christina, a 
fairly powerful combination. Don't get a third 
NPC yet\ 

5. At this point, you may need medical 
attention. The cheapest place you can get this 
is the town of Highland, the closest to Ranger 
Central. If a player is in serious (or worse) 
condition have your best medic (or doctor if you 
have one) stabilize to unconscious. Keep trying! 
The more you use these skills, the better you 
get. If you can't cure a disease or condition, 
go to Highpool and pay for exam and cure, but 
not f or hea ling. To heal cheaply, repeatedly 
press |esc| . (Set something on it if you've got 
a ne or lie.) Make a snack, pop some popcorn, 
get a soda. In 5 minutes or so, they should have 
all their hit points back. {Be sure that they're 
at least UNC first, however. Worse condition 
will kill them!) 

6. Now you're ready for the big bucks. Go 
to Quartz, just on the E side of the river and 
S of Needles. Enter from the NE and go S. 
There you will find a building at the N end of 
a road. Go S. You will find a building on the 
comer. With both Christinas in the lead, fight 
your way in (if you don't encounter a door 
guard, it's the wrong place), get to the back 
room where Felicia is held captive by Ugly. 
Save off. Kill Ugly and the guards and either 
crack the safe or disarm the bomb and blow it 
with the plastic explosive. There's about 
$1000 there. Search the SW of the hideout and 
find and blow the other safe, getting another 
$500 or so. 

7. Find the courthouse (1 building S and 
E of the hideout) and blast your way in. Go to 
the second floor and free Danny Citrine and hire 
him. Go to the 3rd floor and open the SE cell 
(pick or TNT) where Danny will get you 
$1000more. (The BED!!) 

8. Disband Danny permanently, save off 
and repeat 6 & 7 until you have $25000 or 
so. In so doing, you will fight other bad guys, 
get more ammo, money and even an occasional 
sub-machine gun or so and earn experience, 
too. As your characters gain experience, add 
only IQ points for a while. Enter the libraries 
(there's one near the police ammo dump, for 
instance) and add skills. Absolutely necessary 
in the long haul will be assault rifle, doctor and 
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energy weapon skills. Make sure all your 
characters (even NPCs) have them. You should 
also have a couple of players with anti-tank 
weapon capabilities. FinaUy, when these are 
developed, add strength points to one character 
until they're at least at 20. 

9. Now, go back and get another Christina 
(unless you've got another strong NPC 
already.) Pool all your $ to one, disband {Non- 
permanently) your Christinas and go NE to 
Darwin. The fastest way to enter is from the 
SW, but make sure you have radiation suits] 
The building in the SW comer is the black 
market. Blast your way in, sell off everything 
but the canteens and radiation suits and buy 4 
more radiation suits, 7 NATO rifles, at least 
28 clips of ammo and as many Sabot rockets 
as you can afford. You'll also need some TNT 
or plastic explosive if you don't have any. Go 
back and distribute the goodies. You're now 
ready for the REALLY good stuff. 

10. Enter the Citadel. (This is in the 
mountains to the NW of Ranger Central and N 
of the Agricultural station.) Save off to both 
disks! Get as close as possible, then blast 
anything that moves. Have your AT weapon 
characters alternate shots with Sabot rockets, 
LAW rockets or RPG-7s if you have any. Keep 
blasting. You may have to leave and heal your 
characters occasionally, but the Citadel 
characters you kill stay dead, so it eventually 
gets easier. 

In the Citadel, you'll find all kinds of 
energy weapons and power packs. In the NW 
section of the second chamber, there is a library 
where you can get energy weapon capability if 
you don't already have it. As soon as possible, 
equip and start using them. Fight your way 
straight to the back of the hall near the steps 
and portcullis. Enter the door at the left of the 
steps, fight your way to the control wheel and 
get your strongest character to use strength on 
it. Enter the steps and open the safe to the E. 
The combination is "rosebud". This wiU give 
you more power packs and more importantly 
5 suits of power armor, AC 14. Of course, you 
can repeat this with as many disks as you need 
to equip all your troops. If you always seU your 
extra goodies to LeRoy on the same disk, you 
can then 611/ extra power packs, weapons or 
armor if you run out or accidentally lose them. 
With these goodies, you will be able to 
withstand most any of the nasties you encounter 
in Wasteland and be able to concentrate on 
exploration of the world and its puzzles. 



Arthur Simon 



I have been a subscriber to your magazine 
for several years now and have found it to be 
of immeasurable value for backing up my 
valuable software. I recently switched from an 
Apple ne to an Apple Ilgs and, in doing so. 



purchased the Ilgs version of Springboard's 
Certificate Maker. This is a slightly different 
version of the program than that which was 
initially introduced about 2 years ago for the 
He. Although the original version would boot 
and allow one to create a certificate on the Ilgs, 
it failed as soon as you tried to print your 
creation. The new version recognizes the 
capability of printing from the printer port of 
the ngs. 

Unfortunately, when Springboard modified 
the program to work on the Ilgs they also 
apparently changed the copy protection scheme. 
At least it appears that way, since neither the 
softkey in COMPUTIST #39, page 6 nor that 
in COMPUTIST #43, page 24 works on the 
new version. In fact, track $22 is now easily 
readable (this was the track that previously 
caused problems in making a routine copy) but 
track $20 cannot be read by a sector editor. 

<2) Perhaps there is an easy fix to the 
previous softkeys that will work on the new Ilgs 
version. Not being expert in this area, I would 
appreciate if someone could take the time to 
figure one out and offer me a solution. 
Certificate Maker is a very popular program 
and no doubt many other readers with Hgs's will 
be interested in such a softkey. 



Silicon Sorcerer 



Softkey for.. 



Rescue on Fractalus 

Epyx / Lucasfilm 



■ Requirements 

D Apple n computer 

n Original disk 

D Blank disk 

n Copy program that ignores errors 

D Beneath Apple ProDOS (optional) , 

In Rescue on Fractalus, the player must fly 
a jet through alien terrain searching for downed 
pilots. The ship is fitted with antimatter cannons 
and shields, and the enemy consists of 
mountain-top gun emplacements and flying 
saucers. The most striking feature of this 
program is the terrain. As suggested by the title, 
it is made up of 3-D fractal mountains. 
Naturally it is protected, and the protection is 
extremely difficult to bit-copy. Bit-copies 
usually died at track $<Z)(Z>. 

The Protection 

As usual, the first thing I did was watch 
and listen to the boot sequence. On booting, the 
disk seems to load all or most of fracks $0© 
through $07 in order, give the title screens and 
music, and then loaded tracks $08 through $12 



the same way. In a normal boot, the computer 
reads DOS from the first three tracks and then 
moves the head way over to track $11. 
Obviously the programmers were not using 
DOS. 

Next I tried to copy the disk. It copied 
correcdy, indicating that Fractalus probably had 
a normal RWTS. This also meant that I could 
easily sector edit it. However, there was a read 
error on track $00 sector $OB. At first I was 
afraid that my original was already going bad, 
but as it turned out this bad sector was a beacon 
signaling the method of protection. Since the 
protection was on track $0O, boot code tracing 
sounded viable. 

Examination of track $00, sector $00 
showed that it was completely normal for a 
slave disk. This meant that RWTS would be 
loaded from sectors $00 through $09 into 
memory from $B600 through $BFFF, and 
execution of RWTS would begin at $B700. 

The RWTS, on die other hand, had 
obviously been modified. The first line, at 
$B700, had been changed from "STX $B7E9" 
to "JSR $BBOO". $BBOO-$BC55 is RWTS's 
buffer, where sectors are moved during disk 
access, so it is usually filled with garbage. In 
Fractalus it contains the protection code. The 
actual protection code resides at 
$BB34-$BBCB. 

First the routine uses the normal "Read 
Address" subroutine to find physical sector 
$08, which is logical sector $OB. On finding 
the sector, it locates the address header and 
begins reading bytes 9t $BB63. Below is a 
partial listing: 



BB63- 


BD8CC0 


LDA $C08C,X 


BB66- 


10 FB 


BPL $B663 


BB68- 


BD8CC0 


LDA $C08C,X 


BB6B- 


30 FB 


BMI $BB68 


BB6D- 


BD8CC0 


LDA $C08C,X 


BB70- 


10 FB 


BPL $BB6D 


BB72- 


BD8CC0 


STA $C08D,X 


BB75- 


10 FB 


NOP 


BB76- 


BD8CC0 


LDA $C08C,X 


BB79- 


30 FB 


BMI $B676 


BB7B- 


BD8CC0 


LDA $C08C,X 


BB7E- 


10 FB 


BPL $BB7B 


BB80- 


BD8CC0 


LDA $C08C,X 


BB83- 


30 FB 


BMI $BB80 


BB85- 


BD8CC0 


LDA $C08C,X 


BB88- 


10 FB 


BPL $BB85 



There were a few things in this code that 
looked strange to me. The first, a minor one, 
was that the branches were alternately BPL and 
BMI. A BPL in this situation indicates invalid 
data, and why would they want to read that? 
In the past, I recalled seeing only BMI's. The 
answer, of course, is to make sure the program 
didn't read the same byte off the disk twice, 
before the hardware could begin reading the 
next one. An interesting side-effect is that it also 
disables Locksmith's Automatic Boot-Tracer. 



18 



COMPUTIST #61 



November 



The second thing that was strange was the 
bytes the program was apparently reading in 
while it was running. I would boot-code trace 
a bit further and look at the bytes it would read 
and store. Whoi I tried to find them on the disk, 
they were completely different. For example, 
where the program read "EB B6 EF 9A...", I 
would find "FDEDBBE6...". 

The third thing that puzzled me was the 
STA $C08D,X. This location is usually only 
accessed during writing or sensing whether or 
not a disk is write-protected. Actually, I didn't 
figure it out until after I had kracked it. The 
thing that helped me get it was Beneath Apple 
ProDOS, by the authors of Beneath Apple 
DOS . In the back of the book there is a section 
on the "state-sequence ROM". If $C08E,X 
and $C08D,X are accessed, as they are here, 
the ROM goes to sequence ifO and stays there 
until the state is changed, as it is in this case 
by the command LDA $C08C,X. This 
command comes 6 machine cycles later. So the 
effect this routine has is to extend the time used 
to read the byte by 6 cycles, or about 1.5 disk- 
bits (each disk-bit takes about 4 cycles to be read 
in). 

To understand the significance of this, we 
will have to examine the disk-bits on a binary 
level. Below are the bits immediately following 
the Address Header (D5 AA AD) of sector 
$03: 
11111111101011111010111110011110111... 

Normally, the bits are divided into groups 
of 8 by the hardware as follows: 
11111111 10101111 10101111 10011110 111... 

Most nibble-editors display this bit stream 
in hexadecimal: 
FF CF CF 9E 

This is what you see when you read the disk 
normally with a nibble-editor. Remember, 
though, that Fractalus adds 6 cycles to the third 
byte, giving us: 
11111111 10101111 101011111 00 11110111 ... 

The two zeros are droi^)ed because all disk- 
bytes must begin with a "1". The hardware 
treats the third byte as a sync-byte. This gives 
us, in hexadecimal: 
FF CF XX F7 

The third byte is uncertain, since shifting 
states in the middle of a read tends to destroy 
the read byte. 

Notice that normally there are 3 binary ones 
left over, which become part of the fifth byte. 
In die Fractalus read, these bits have been used 
up. This will change the next group of bytes 
completely, just as it changed the fourth byte 
here! Normally they would be "FD ED BB 
E6.. .", but now they are "EBB6EF9A...", which 
is what Fractalus looks for! In short, this is a 
way to hide protection information from 
hackers' prying eyes. In addition, bit copiers 
have trouble reading the "sync bytes" 
perfectly, so bit copies usually fail. 

Now, after Fractalus reads in the next $1© 



bytes, it goes through a mess of adds, 
eXclusive-ORs, and logical "and"s in an 
attempt to confuse any would-be krackist. It 
then stores the results at $3F0 and $3F1 and 
zeroes locations $70 and $71. This is to keep 
us from simply bypassing the protection routine. 
I found the needed results easily by boot- 
tracing. $3F0 and $3F1 should be D7 and F9. 
Incidendy, it is possible to boot-trace on a lie, 
but it is a litde more tricky, as critical bytes 
can change mysteriously. 

To softkey Fractalus, I simply overwrote 
part of the protection code with code to change 
the 4 above locations and continue. Below is 
a disassembly: 

BB34:LDA #$D7 
STA $03F0 
LDA #$F9 
STA $03F1 
JMP $BBC5 

Address $BB34 is on disk at track $00, 
sector $05, byte $34. 

Step by Step 



POKE 47426,24 
RUNCOFTA 



I 1 I Copy with any whole-disk copier that 
can ignore errors. Copy n Plus's "copy disk" 
option is fine. Don't use an unmodified 
COPYA, as it will die on pseudo-sector $OB 
of track $00. 



i 2 I Make the following sector edit to the 
copy: 

Trk Set Byte(s) From To 

$00 $05 $34-$40 A9 10 85 FF C6 A9 D7 8D F0 03 
FF D0 03 4C C6 A9 F9 8D Fl 03 
B6 20 44 4CC5BB 



I 3 I (Optional) Change skewing to 
4-descending. This will greatly reduce 
loading-time. 



Charles Taylor 



Softkey for... 



Deatbsword 

Epyx 



■ Requirements 

D COPYA 

D Sector Editor 

D 128K Apple 

Deathsword can be cracked using an 
adaptation of Mr. Nissel's "Arctic Antics" 
procedure on page 25 of COMPUTIST )i^6. 

I 1 I Boot your DOS 3.3 system disk. 

I 2 I Tell DOS to ignore checksum and 
epilog errors and use COPYA to copy the disk. 



I 3 I Make the following sector edits to the 
copy you just made. 

Trk Set Byte(s) From To 

$00 $0E $4A-4B 00 F4 EAEA 

$53-54 D0 46 EAEA 

$5C-5D D0 3D EAEA 

$6F-70 D0F4 EAEA 

$71-7E A0 07BD8CC0 EAEAA9FC85 
10FBD1F6D0 F0 85F3A9EE 
IF 88 10 F4 85 Fl 85 F2 



Softkey for... 



Gauntlet 

Mindscape 



Gauntiet is deprotected by a scheme 
identical to The Twit's "Infiltrator" Softkey 
on page 8 of COMPUTIST #56. 

I 1 I Boot your DOS 3.3 system disk. 



I 2 I Tell DOS to ignore checksum and 
epilog errors and use COPYA to copy the disk. 

POKE 47426,24 
RUNCOPTA 



I 3 I Make the following sector edits to the 
copy you just made. 

Trk Set Byte(s) From To 

$00 $03 $42 38 18 

$08 $EA-EC 20 00 02 EAEAEA 

Softkey for... 



Cofa Courseware 

Emtech 



■ Requirements 

D SREAD/SWRTTE (ftom COMPUTIST #24) 

n Fast copy program 

D lO blank disk sides 

D Method of copying DOS to disk (optional) 

Cofa Courseware is a series of 5 double- 
sided math disks aimed at senior high school 
stodents. The disks all are normal format 
(COPYA-able), but the copies don't run. At 
first the simple protection on these disks had 
me smmped, since the scheme hasn't been used 
in a number of years. Many thanks to Bluebeard 
for reacquainting me with this protection 
scheme. 

The reason the COPYA copies don't work 
is that the catalog track has been moved fi-om 
its normal track $11 to $23. COPYA only 
copies through $22. The deprotection is simple 
also. It involves moving the catalog back to 
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track $11, sector editing all of the track $11 
sectors so that byte $01 is 11 instead of 23, then 
copying a new DOS from the system master to 
the copy. 

I used SREAD/SWRTTE to read in track 
$23 from the original and write back to track 
$11 of copy, sector by sector. This laborious 
process might be OK for one side, but ten sides? 
I then wrote a BASIC program to normalize the 
catalog track, including the correction of the 
catalog track numbers. (POKE D,17) 

I 1 I Copy all ten sides with a fast copy 
program. 

I 2 I Type in the BASIC program and 
SAVE COFACOPY on a disk containing 
SREAD/SWRTTE. Be aware of the typo in 
COMPUTIST #24. The line "BSAVE 
SREAD/SWRTTE, A$300,L$3A4" should 
read "BSAVE SREAD/SWRTTE, A$300, 
L$A4" 



m Run COFACOPY. COFACOPY will 
prompt you to insert the originals and copies. 
Be sure to write protect the originals. 

I 4 I Copy a normal DOS to the copies. 
Lacking a method to copy DOS, copy all files 
to an initialized disk. 

Softkey for... 



Matbbusters 

Spinnaker 



■ Requirements 

D copy program 

D sector editor (optional) 

Mathbusters can be copied with COPYA, 
but the copy won't run until the protection is 
defeated. Here's how I found the copy 
protection: 

A catalog of the disk shows several 
programs with either He or He in the title. I 
reasoned that the first useful fimction of the 
program is to determine whether it was running 
on a He or He. A program can do this by 
checking the bytes at $FBB3 and $FBCO and 
comparing witii the following table: 



FBB3 



FBC0 



Type 



06 



O06 



EA 
E0 



lie 
Me 

enhanced I le 
II or 11+ 



A sector editor found the $FBB3 and 
$FBCO references on track $1E, sector $07. 
A catalog of the disk showed this sector to be 
part of BOOTER.OBJ, which loads in at 
$92DO and is $2BE in length. The first 
instruction in BOOTER.OBJ is a JMP to 
$93B7. The FBB3 was located at $9402. (At 
this point I had bloaded BOOTER.OBJ from 



DOS, rather than using the sector editor so that 
I could look at the actual memory locations.) 
I made my non-working copy into a working 
copy by changing the $93B7 to $9400. 

I 1 I Copy Mathbusters with a fast copy 
program. 

I 2 I Sector edit 



Trk Set Byte(s) From 



To 



$1E $08 $05-06 B7 93 



00 94 



m OPTIONAL method 

BLOAO BOOTER.OBJ 

CAU-151 

9201:00 94 

BSAVE BOOTER.OBJ, A$92O0, 1.$2BE 



I would like to comment about your back 
issue section. How about different sections for 
SW" disks, Vh" disks, and Hgs software? It 
would make things less confusing, and if 
someone orders a back issue for a particular 
piece of software, he can be sure that he won't 
get a softkey for the wrong type of disk or 
computer. 

S That's a good idea but it would be almost 
impossible to do. Many readers do not send the 
requirements list with their softkeys. And they often 
do not mention what kind ofrnedia the program 
is on. Unless it's part of the name, sometimes we 
can't even tell which computer the softkey is for. 
So, if we separated the ones that we know into 
different sections, you would still have to search 
the main body of text for the ones that fell thru 
the cracks. Your best bet is to send us a letter 
requesting more info on the particular software that 
you are interested in. RDEXed 

Softkey for... 



Presenter 

MECC 



■ Requirements 

n 1 blank ProDOS di^ 
D a file copier 

MECC software has never had very intense 
protection, and the Presenter is no exception. 
It changes the epilogue bytes from DE AA to FF 
AA and quits to ProDOS if its altered device 
driver is not present in memory. 

To deprotect the Presenter, boot a ProDOS 
disk and get into BASIC. Next, tell the device 
driver in ProDOS to ignore read errors. This 
is similar to a POKE 47426,24 in DOS 3.3 
except that it only ignores checksums and 
epilogues, not all read errors. Here is the 



procedure for ProDOS vl.l-vl.4 (vl.O 
addresses are in italics): 

CALl-151 

CM9CeB9 

D3E4:18 60 iFBE4) 

D4CC:18 {FCCQ 

C08A 

Now execute your file copier and copy a 
normal version of PRODOS onto the blank 
disk. Then copy all the files except PRODOS 
from the MECC disk onto the blank disk. 

All that remains to be done is to stop the 
routine in MECC. SYSTEM that executes the 
ProDOS quit command if its device driver isn't 
present: 

BLOAD MECC.S7STEM,A$2000,TSTS 

CALL-lSl 

93B:18 was 38 

BSAVE HECC.STSTEH,A$2000,TSTS 

Softkey for... 



Catalyst 3.0 

Quark Inc. 



■ Requirements 

D 3V4" disk copier 
D 1 blank 3W disk 

I know there have been other softkeys for 
this program in the past, but I don't know if 
they were for the 5W" disk or the 3%" disk. 
Mine is for the 3'/4" disk. 

Blocks $08-$17 are stored on the disk in 
such a way that ProDOS can't read them, but 
they contain code that is necessary for the 
program to run. It is the job of 
CATSTART.SYSTEM to read these blocks 
into memory. Once in memory, a routine is 
executed that checks for the abnormal blocks. 

To deprotect Catalyst 3.0, follow these 
steps: 

I 1 I Copy the disk, ignoring the errors on 
blocks $08-$17. 

I 2 I Get into BASIC by executing 
BASIC.SYSTEM. 



m By loading in CATSTART.SYSTEM 
at its relocated address, you can execute the 
code that reads the abnormal blocks: 

BLOAO CATSTART.STSTEH,A$COe,TSTS 



I 4 I Before executing the code, put a 
BReaK instruction right after the code that reads 
the abnormal blocks: 

CALL-151 
047:00 



I 5 I Execute the code: 
C5FG 
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I 6 I Once you hear the beep and see the 
registers, all the code has been read in. 
Actually, CATSTART.SYSTEM has no other 
purpose than loading those blocks, and it won't 
be used anymore. Instead, you can make a 
system file out of the code that was just read 
in. First, clear some memory: 

2000:0 N 2001<200e.20FEM 



Softkey for... 



I 7 I Now enter the relocator that will move 
the code to its proper address: 

2000:A2 00 BD 00 40 9D 00 SF 
2008:E8 DO F7 CE 04 20 CE 07 
2010:20 AD 07 20 C9 3F DO EA 
2018:4C 00 40 



I 8 I Move the disk code to its new location 
so that it can be saved: 

2100<4000.5FFFH 



9 I You may have noticed a file named 



CATALYST.3.0 in the catalog. This file is 
located on blocks $08-$ 17 and kept these 
blocks ft-om being allocated to files that were 
later saved to the disk. This is an ideal place 
to save the code: 

UNLOCK CATALYST.3.0 

BSAVE CATALYST.3.0,A$2000,L$2100,TSYS 



I 10 I Lastly, give CATALYST.3.0 a new 
name so that PRODOS will be able to find and 
execute it: 

RENAME CATALYST.3.0,CATALYST.SYSTEM 

C2) I don't know much about 3'A" 
disks, and I want to know how Catalyst could 
make the device driver read blocks $08-$ 17 
when ProDOS couldn't. If anybody knows 
where I could find a book explaining 3 Vi " disk 
formatting and the usage of its device drivers 
or if you could explain it yourself, I would like 
to hear from you. I would also like to read more 
about Vh" diskette protection schemes and 
about using the drive independent of the device 
driver. You may write to me at; Route 1, 
Plymouth, WI 53073. 



MJ Howard 



Here are a few cracks that have worked for 
me on G.I. Joe by Epyx and Tink's Subtraction 
Fair by Mindscape. Not exactly hot stuff, but 
bit copies of them would not work, therefore 
the protection on them had to be removed. 

Using past issues of Computist (a valuable 
reference) I found sector edits of programs from 
Epyx and Mindscape that would work on my 
disks, but on different sectors. 

I determined which sectors to be edited by 
scanning the disks for the indicated byte 
sequence to be changed. 



link's Subtraction Fair 

Mindscape 



I 1 I Boot your DOS 3.3 system disk. 

I 2 I Tell DOS to ignore checksum and 
epilog errors and use COPYA to copy both 
sides of the disk. 

POKE 47426,24 
RUN COPYA 



I 3 I Make the following sector edits to the 
copy you just made. 

Trk Set Byte(s) From To 



$05 $5F-61 20 44 B9 



EA EA 60 



Softkey for.. 




I 1 I Boot your DOS 3.3 system disk. 

I 2 I Tell DOS to ignore checksum and 
epilog errors and use COPYA to copy the disk. 

POKE 47426,24 
RUN COPYA 



3 I Make the following sector edits to the 



copy you just made, 
on side 1: 

Trk Set Byte(s) From 



To 



$00 $01 $00-lF A9 0A 85 F4 A6 A9 FC 85 F0 A9 
2B BD 89 . . . EE 85 Fl A9 EE 
85 F2 A9 FC 85 
F3 A9 E7 85 F4 
A9 EE 85 F5 A9 
FC 85 F6 A9 E7 
85 F7 
$20-79 ? allEAs 

<2) While I have had much success 
backing up my disks using sector edits and 
modifying disks slightly, your lOB program 
really puts me off. I have never been able to 
get the hang of it and receive a variety of error 
messages whenever trying to use it. Whether 
installing a standard controller or typing in a 
new one from the magazine, it never works. 
Is it just me? 



i. 



Most of our readers don 't have any problem 
using Super lOB (SIOB). You don't say what 
computer you are using or exactly what you were 
doing when you got the error messages, nor what 
the error messages were, so I can't tell what's 
wrong. However, here are some of the problems 
most often encountered the first time a reader tries 
the SIOB program: 



1. Trying to run SIOB without a controller. 
The SIOB on your Starter Kit disk is bare. You must 
LOAD SIOB. then EXEC a controller into it, then 
RUN it. Use CAPTURE on the Starter Kit disk to 
convert an Applesoft controller into an EXECutable 
file. 

2. Trying to run a controller without SIOB. 
The controller is the heart of the SIOB program. 
The SIOB program is a shell of useful routines. The 
controller calls (GOSUBs) these routines in the 
proper order to copy a disk. The controller is not 
a standalone program. 

3. LOADing SIOB then LOADing a controller 
ByLOADing the controller, you dumped SIOB and 
only the controller is left in memory. (See 112} You 
must EXEC a controller after you ha ve LOADe d 
SIOB. then type "RUN" and press IretuknI . 

4. Variations on 113 result in It I and 112. IE. 
LOADing the controller then LOADing SIOB, 
LOADing SIOB and RUNning the controller, etc. 

5. Trying to use the swap controller without 
first saving the RWTS. The swap controller uses 
the RWTS from a protected DOS to read a 
protected disk. You must first capture and BSA VE 
the RWTS from that protected disk. 

I'm sure we can find out why SIOB isn't 
working for you. Why don't you give it another 
shot? RDEXed 



Jack Nissel 



Softkey for. . 



Tower ofMyraglen 

PBI Software 



■ Requirements 

D 2 blank 3.5 disks 

D Any fast copy program that can ignore errors 

D A sector editor 



I 1 I Copy the original disks to your blank 
disks and ignore a read error if one is 
encountered. 



I 2 I Make this sector edit to disk 1. 

Bloek Byte(s) From To 

$40F $72-75 22 CB IB 00 EA EA EA EA 



I 3 I Write the sector back to the disk. 
Softkey for... 



Cannonbali Blitz 

Sierra On-Line 



■ Requirements 

D 1 blank disk 

n A sector editor 

n COPYA (from DOS 3.3 system master disk 
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I 1 I Boot your DOS 3.3 system disk. 

I 2 I Tell DOS to ignore checksum and 
epilog errors and use COPY A to copy the disk. 
POKE 47426,24 
RUN COPTA 



I 3 I Make the following sector edits to the 
copy you just made. 

Trk Set Byte(s) From To 

$17 $0E $CD ? 60 

I 4 I Write the sector back to the disk. 



Softkey for.. 



PFSFILE 
PFS GRAPH 
PES REPORT 

Software Publishing Corp. 



The following softkey is from 
CompuServe's Apple MAUG. This information 
is only for the purpose of combining these three 
popular programs to one VA" disk or for 
making 3 Vi " copies that will boot on the Ilgs. 

All three programs are de-protected 
identically. Make these changes to copies of the 
files, NOT the originals! Six bytes need to be 
changed in the .SYSTEM file. Make the 
changes from BASIC. 

BLOAD /jw»fir/FILE.SYSTEM, TSYS, A$1000 

CALL -151 

1207:A9 

120E:A9 

12E0:EAEA 

12E8:EA EA 

BSAVE /i»»ffir/FILE.STSTEH, TSTS, ASlOOO 

Repeat the above for GRAPH. SYSTEM 
and REPORT.SYSTEM. Write protect the 
copy. 



Gary Verbuch 



I would like to thank the volunteers at 
COMPUTIST for responding so quickly with 
my subscription. Within two weeks after 
sending a check I received my first issue. Now 
that's service. 

I've been deprotecting software for years 
now and I never thought of it as a hobby, more 
like a necessity. I will not use an original piece 
of software until I have produced a working 
copy. Unfortunately, with some products it can 
take some time when the disk format is 
completely altered. 

After reading Computist #57 it's evident 
that readers have been complaining about the 
softkeys not containing enough information 
about the protection or the process of 



deprotection. Mr. Hart's article was a good 
general discription of the protection schemes 
used on Apple software. He mentioned in his 
article a table of changes to DOS for reading 
altered address and data marks in an earlier 
issue. Since I do not own any reference material 
on DOS 3.3 I had to dissasemble it to find out 
what makes it tick. For the readers who, like 
I, do not have that issue, I have compiled a list 
of changes to read altered formats. I will also 
include some important DOS locations that I 
find helpftil when deprotecting 3.3 software and 
some pointers on the ProDOS MLI (machine 
language interface). 

Important Locations 

$3EA Reconnect DOS input/output hooks. 

$AC01 Catalog track # 

$A884-A907 DOS command locations 

JMP to $FAA6 Sneaky way to cause the disk to 

reboot 
$AA60-AA6 1 Length of the last bloaded file (low 

byte/high byte) 
$AA72-AA73 Address of the last binary file (low 

byte/high byte) 
$A964 : FF Allow a large BSAVE. On a single 

load program you can BSAVE the 

program to a normal DOS disK. 

RWTS calls 

$3E3 Return the address of the lOB (input 
output block). Before a call to the RWTS 
a JSR to 3E3 returns the adress of the lOB 
(Y reg lo-byte, A reg hi-byte). 

$B7E8-B7F8 The normal lOB location 

$3D9 The acmal call to the RWTS is done by a 
JSR to 3D9 (20 D9 03) . Any track or 
sector can be accessed thru this call, 
including a check on track 36 ($23). 

$BA29-BAFF Read/Write translate tables. 
Sometimes you will notice the data on the 
disk looks garbaged , no readable code. 
Check the Write translate table 
(BA29.BAFF) and the Read tranlate table 
(BA96.BAFF) on a normal DOS and 
compare them to your protected disk. One 
byte changed will garbage the data and 
make it unreadable by a normal DOS. The 
read table is usually the one altered but I've 
included both locations. 

ProDOS 8 

$B8D1-B93E DOS command table 
$BEC8-BEC9 Last BLOAD length 
$BEB9-BEBA Address of last BLOAD 

To allow DOS to ignore changes to 
standard address and data markers use the 
following. 

To ^nore Address Prolog 

D5 - $8954 : 29 00 POKE 47444 , 41 POKE 47445 , 
AA - $B95E : 29 00 POKE 47454 , 41 POKE 47455 , 
96 - $B969 : 29 00 POKE 47465 , 41 POKE 47466 , 



To ignore Address Epilog 



DE-$B993:{ 
AA-$B99D;(! 



POKE 47507,0 
POKE 47517,0 



To ignore both: 

$B988:18 60 POKE 47496,24 POKE 47497,96 

To ignore Data Prolog 

D5-$B8E6:29 00 POKE 47334,41 POKE 47335,0 
AA-$B8F3;00 POKE 47347,0 
AD-$B8FE:00 POKE 47358,0 

To ignore Data Epilog 

$B925; 18 60 POKE 47397,24 POKE 47398,96 

To ignore RWTS errors 

$BE48;18 POKE 48712,24 

To ignore Checksum and Epilog 

$6942:18 POKE 47426,24 

To ignore Data Checksum 

$B920 : EA EA POKE 47392 , 234 POKE 47393 , 234 

ProDOS 

A good percentage of software I've 
deprotected that uses ProDOS 8 or ProDOS 16 
looks for a bad block or has an altered disk 
format. A ProDOS block is the equivalent of 
two DOS 3.3 sectors and at the disk level there 
is no difference between ProDOS or 3.3. Since 
it is beyond the scope of this article to cover 
either ProDOS version in detail, I will include 
the MLI (machine language interface ) call most 
often used in protection methods. Keep in mind 
when scanning a disk for a direct read (LDA 
C08C,X OR LDA C0EC), that other methods 
are available in a ProDOS environment. 

ProDOS 8 

ProDOS 8 MLI calls begin with a JSR 
$BFOO (which is the entry point to the MLI) 
and are immediately followed by three bytes. 
The first byte will contain the command code 
($80 for Read Block) , followed by two bytes 
that form a pointer to the parameter block. What 
is contained in this block depends on the type 
of MLI call issued. After a call is completed, 
the code following the three bytes is where 
execution resumes. If an error occured during 
the MLI call then the carry fl^ is set. In normal 
use I will use BCS to test for an error. On a 
disk checking for a bad block the code will be 
expecting an error and often tests for the carry 
bit clear. Either test of the carry bit can be used. 

Here is an example of a Read Block call 
to test for a bad block. 
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ProDOS 8 - Read Block 



2000: 


20 00 BF 


MU entry point 


2003: 


80 


ammmd code for Read Blod 


2004: 


77 77 


address ofparm bhd, defined by user 
fo-byte/M-byte order) 


2006: 


90?? 


branch on carry clear to crash -bbd was 
read and an error did not occur 


????: 


03 


parm block -Ist byte will be 03 


77??: 


?? 


2nd byte will contmn device A drive # 


????: 


7? ?? 


3rd and # byte will contain tiie pointers 
to the data buffer fo-byte/M-byte order) 


????: 


?? ?? 


byte 5 A 6will contain the kgicalblod It 
to read (lo-byte/M-byte order) 



ProDOS 16 

When a system block call is used in this 
environment there are a few minor differences 
because of the memory c^)acity of the Ilgs. The 
format of an MLI call is the same but the entry 
point is in bank $E1. The pointer to the 
parameter block and the definitions within the 
block have to accommodate the increased 
memory range . I will include an example 
similar to the ProDOS 8 version. 

ProDOS 16 - Read Block 

2000: 22 A8 00 El JSL to MU entry pmiu ($£1/00/18) 
2005: 00 22 read blod command code i$22), 2 

bytes 
2007: ???????? user d^nedaddr of parm blod 

(b/U/bank), 4 bytes 
BCS OR BCC carry set, blod is bad ■ carry clear, 

blod is good 
????: ???? PARM blod, byu 0-1, device f 

????: ???????? byte 2-5, pointer to data buffer (lo/hi) 
1111: 11111111 block to read, lloM order) 

I hope the above information will help some 
of the readers who are not familiar with the 
ProDOS environment. In comparison to other 
Disk operating systems I've worked with 
(Unix.Xenix) in the past, I find DOS 3.3, 
ProDOS 8 & 16 very easy to learn and write 
systems software for. If you are new to 
deprotecting software I recommend getting a 
DOS reference manual and start dissasembling 
the read, write and boot code. The DOS 3.3 
table I've included is a result of studying the 
routines to read and write directly thru the 
device select address range ($COEO-COEF). 

(^ By the way, are there any readers 
familiar with the Scheme dialect of Lisp or a 
versioi\Aat does lexical scq>ing by de&ult. I've 
come ^p with some interesting coding 
techniques that I'd like to share. 



Craig Meekins 



Broadsides by SSI is a very intriguing war 
game. You are in command of an authentic 
sailing warship out to devastate French, 
Spanish, English, or American Warships in one 
on one high seas combat. If you don't like the 



vessels the computer can supply you with there 
are options to customize your own super frigate, 
or you can customize the enemy to be as tough 
or as weak as you want them. 

Softkey for... 



Broadsides v2.0 

Strategic Simulations Inc. 



The trouble is SSI has protected this game 
in such a way that Locksmith 5.0, EDD 4.7, 
and Copy 11 Plus 8.2 will not give a working 
backup even with extensive parameters. I 
naturally turned to COMPUTIST back issues 
for help. There seemed to be no listing for it 
in previous issues, but several SSI games were 
documented. Study of these previous techniques 
led to this softkey. 

Remember previous issues that cover the 
same company are a great starting point for 
protected programs that are not listed. 

The Protection 

1 . The even tracks all have standard address 
prologs of D5 AA 96, however the odd tracks 
have nonstandard address prologs of D4 AA 96. 

2. The address field epilog bytes have been 
changed from DE AA on all tracks to read AF 
followed by a random byte that varies from 
sector to sector. 

The Procedure 



I 1 I Boot a DOS 3.3 System Master and 
alter DOS to read Broadsides original disk. 
CAU-151 
B9S4:4A d^kXMU to dkwDS cmdD4 in 

address prolog 
B988:18 60 to ignore address epilog errors 
3D0G 
RUNCOFYA 

I 2 I Break out a sector editor and edit track 
$00, sector $0C to allow DOS to read then 
new address epilogs. 

Trk Set Byte(s) From To 



$00 $0C $A9-AA AS D0 



18 60 



You should now have a unprotected 
BROADSIDES. If any one is using Keith 
Parker's PICTURE LOADER (COMPUTIST 
#54) you can capture the boot up screen by 
reading starting at track $04, sector $13 
forwards. 



Softkey for... 



Aztec 

Datamost 



Here's a quick one for a old Advenmre 
/Arcade game. The Prologs have been changed 



from D5 AA 96 to AA D5 AD for the address 
field and from D5 AA AD to AA D5 96 for 
the data field. The Epilogs have been changed 
from DE AA to AA AA and D5 AA for the 
address and data fields respectively. 

rrn INIT a Wank disk with a fast DOS (I 
used ProntoDOS). 

mrr AZTEC 



2 I Enter the confroller below into Super 



lOB 1 .5 and run it answering no when prompted 
to format. 

Controller 

1000 REM AZTEC CONTROLLER 

1010TK = 3:LT = 31:CD = WR:MB = 151 

1015 POKE 47426, 24 

1020 ST = 0:T1 = TK: GOSUB 490: RESTORE : GOSUB 

190:GOSUB210 
1030 GOSUB 430 : GOSUB 100 : ST = ST + 1 : I F ST < 16 

THEN 1030 
1040 I FBF THEN 1060 

1050 ST = : TK = TK + 1 : I F TK < LT THEN 1030 
1060 GOSUB 230 ; TK = Tl : ST = : GOSUB 490 
1070 GOSUB 430 : GOSUB 100 : ST = ST + 1 : I F ST < 16 

THEN 1070 
1080ST = 0:TK = TK+1: IFBF = 0ANDTK<LTTHEN 

1070 
1090 I FTK<LT THEN 1020 
1100 HOME :A$ = "ALL'DONE' : GOSUB 450: END 
5000 DATA 170,213,173,170,213,154 

Checksums 



1000 - $356B 

1010 - $9ACF 

1015 - $BDA8 

1020 - $0510 

1030 - $DEBE 

1040 - $80CF 

1050 - $4E18 



1060 - $CE4A 
1070 - $8E01 
1080 - $A88C 
1090 - $836E 
1100 - $C53E 
- $4F55 



There you have it. Enjoy it and watch out 
for the dragons! 



i. 



This softkey is only slightly different from Leo 
SEric Van Der Loo's softkey in COMPUTIST i53, 
page 1 2. But it is a bit easier. RLXXed 



J.L. Walters 



Softkey for.. 



Mia'ozine/25 

Scholastic 



Microzine #25 has the same protection 
scheme as Microzine #24 which was detailed 
in COMPUTIST #57 on page 9. The only 
difference is that the file name of the nibble 
count routine was changed from CP.OPTIONS 
to T0C.6. See COMPUTIST #57 for a detailed 
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description of the nibble count routine. 

I 1 I Copy both sides of Microzine #25 
using your choice of copy programs. 

I 2 1 Boot your DOS 3.3 System Master. 

I 3 I Place side one of Microzine #25 in 
your drive. 

LOAD HELLO 



3 

SAVE HELLO 

The disk is deprotected. 
Softkeyfor... 



Mcrome lSf26 

Scholastic 



Microzine #26 is normal on all even tracks 
and has an altered address prolog of $D4 on 
all odd tracks. The solution can be seen by 
looking at an article by Bill Jetzer in 
COMPUTIST #53 on page 7. There, Bill gives 
the modifications needed to cause Super lOB 
1 .5 to read from every other track. In addition, 
he offers two controllers. We appropriate the 
second, "Colonial Conquest/Blue Powder, 
Grey Smoke" (only the REM statement in ours 
is different). See that article for explanations. 

Note: Look at lines 1020 and 1030. Bill has 
shown us a powerful technique in these two 
lines. Consider, if the protection scheme is 
different for every track, you can simply set up 
a different line for each (35 total for DOS 3.3) 
with the appropriate PEEKs and POKEs. Read 
COMPUTIST it53 for his explanation; it is truly 
something to consider at length. 

The following assumes you have two 5 W " 
disk drives. If you have only one, 
modify as appropriate. 

I 1 I Use your favorite DOS 3.3 text editor 
(Applewriter DOS 3.3 is perfect) to create the 
following SINGLE line and store it as 
' 'CONTROLLER TO TEXT' ' on the disk that 
holds your copy of Super lOB. Note the space 
before the zero! 

'0 D$ = CHR$ (4) : I NPUT "CONTROLLER'NAME ? " ; A$ : 
PR I NT D$"OPEN"A$" . CON" : PR I NT 0$"WR I TE" 
A$".CON": LISTl- ; PRINT D$ "CLOSE"; END 



I 2 I Boot your DOS 3.3 System Master 
disk. 



I 3 I Put the Super lOB disk back into drive 
1 . Type in the controller and save it. (Saves 
your typing in case things go wrong later.) 

rp 

Controller 



1020 TK = 0:LT = 36 iGOSUB 1050 
1030 TK = 1:LT = 35 :GOSUB 1050 
1040 HOME : PRINT "COPY'DONE" : END 

1045 REM USE "TK/2 =' IF D4 IS ON EVEN TRACKS 

1046 REM USE "TK/2>' IFD4 ISON ODD TRACKS (OUR 
CASE) 

1050 POKE 47426, 24: IFTK/2> INT (TK/2) THEN 
POKE 47445,212 

1060 GOSUB 490 :GOSUB 610 

1070 GOSUB 230: GOSUB 490: GOSUB 610: IF PEEK 
(TRK)=LT THEN RETURN 

1080 TK = PEEK (TRK) : ST = PEEK (SCT) ; GOTO 1050 

Checksums 



1046 - $8E1C 

1050 - $4045 

1060 - $4865 

1070 - $5F45 

1080 - $ADAA 



- $356B 
1010 - $0A5A 
1020 - $CF7E 
1030 - $0C52 
1040 - $E9AB 
1045 - $A2E6 



SAVE CON.MICROZIIIE.26 



I 4 I Execute the file you made in step 1. 
This will insert the line you saved as a text file 
in step 1 into the controller as line zero. Then 
run it. 

EXEC CONTROLLER TO TEXT 

RUN 

MICROZINE.26 When it ash 

This will save the file as "MICROZINE.26 
.CON" on the disk (without line zero). Note 
that text controllers have a suffix of "CON" 
while Applesoft controllers have a prefix of 
"CON.". 



I 5 I Load Super lOB and add the following 
lines. 

LOAD SUPER lOB 1.5 

630 REM READ/mtriE EVERT OTHER TRACK 

640 POKE 904,32 : POKE 905,168 : POKE 906,3 

: POKE 936,238 : POKE 937,14 : POKE 

938,3 : POKE 939,238 : POKE 940,14 : 

POKE 941,3 : POKE 942,96 : RETURN 

650 REM READ/WRITE EVERT TRACK 

660 POKE 904,238 : POKE 905,14 : POKE 906,3 

:RETURN 
SAVE SUPER lOB 1.5 

These lines modify SUPER lOB so it can 
read/write every other track for the this and 
future controllers. 



1000 REM CON. MICROZINE #26 
1010ST=15:LS = 15:CD = WR:FAST = 



1: GOSUB 640 



I 6 I Now merge the Microzine 26 
controller and run the program. 

EXEC inCROZINE.26.CON 
RUN 

Follow directions and answer drive 
questions. Answer "Y" to format the 
destination disk. Remove the Super lOB disk. 



I 7 I P ut Microzine #26 in drive 1 and press 
iHETUltHl . When the message COPY DONE 
is printed, remove the original MZ #26 and 
replace with your DOS 3.3 System Master and 
boot it. 

PR#6 

RUN MASTER new Master Create 

The greetings program is "HELLO" when 
prompted. 

I 8 I Remove the System Master disk and 
put the copy in drive 1 when prompted. 
The disk is deprotected. 



Ted E. Bare 



Softkey for... 



One on One 

Electronic Arts 



I tried the softkey in COMPUTIST #49 on 
my version of One on One but it crashed at track 
$03. I had already copied with Copy II Plus 
but I wanted it deprotected completely. I loaded 
Copy n Plus and checked the parameters they 
used for copying and found that tracks $03-06 
were skipped completely. I modified the 
COMPUTIST #49 controller to skip to track 
$07 after track $02 and it works perfecdy. The 
sector edits are a little different also. Here is 
the modified controller and a table showing 
bytes changed. 

(These edits are done automatically by the 
controller and are shown here only for clarity, 
you don 't need to do them yourself.) 



Trk Set Byte(s) From 



To 



$02 $03 $47 $B6 $AA 
$03 $51 $CF $AD 
$01 $06 $08 $03 $62 
$0C $04 $00-09 4C 69 BD A0 20 A0 03 A2 FF A9 
88 F0 58 AD EC 09 18 60 04 IE 

Keep up the good work, the magazine looks 
fine without the glossy cover. Like they say 
'you can't judge a book by its cover' . 

I would also like to say I would like to see 
the hardware comer kept on. A proji|t that 
might be interesting would be a digital readout 
of the track and sector your disk drive is on. 



i 



/ know you haven't heard much from the 
hardware comer, but we are working hard to turn 
Bobby's notes into complete projects, with step- 
by-step assembly instructions and a finished board. 
Unfortunately, that sort of talent is usually working 
full time already and can only spare a little each 
week on a volunteer basis. Hang in there. 
RDEXed 
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Controller 



1000 REM ONE ON ONE (NEW VERSION) 
1010TK = 0:ST = 0:LT = 35:CD = WR 
1020 Tl = TK ; GOSUB 490 ; I F TK > 3 THEN RESTORE 

: GOSUB 210 
1030 GOSUB 430 : GOSUB 100 : ST = ST + 1 : I F ST < DOS 

THEN 1030 
1035 I FTK = 2 THEN GOSUB 210 
1040 I FBF THEN 1060 
1050ST = 0:TK = TK+1 + (TK = 2) * 4: IFTK< LT 

THEN 1030 
1060GOSUB310: GOSUB 230: GOSUB 490 :TK = T1: ST 

= 
1070 GOSUB 430 : GOSUB 100 : ST = ST + 1 : I F ST < DOS 

THEN 1070 
1080ST = 0:TK = TK+1 + (TK = 2) * 4: IFBF = 

AND TK<LT THEN 1070 
1090 I FTK<LT THEN 1020 
1100HOME : PRINT : PRINT "DONE'WITH'COPY" : END 
5000 DATA 213,187,207 
5010 DATA 13'CHANGES 
5020 DATA 2, 3, 71, 170 
5030 DATA 2, 3, 81, 173 
5040 DATA 1,6,8,98 
5050 DATA 12,4,0, 160 
5060 DATA 12,4,1,3 
5070 DATA 12,4,2, 162 
5080 DATA 12,4,3,255 
5090 DATA 12,4,4, 169 
6000 DATA 12,4,5,9 
6010 DATA 12,4,6,24 
6020 DATA 12,4,7,96 
6030 DATA 12,4,8,4 
6040 DATA 12,4,9,30 



Checksums 


1000 


- $356B 


5020 


- $06C8 


1010 


- $3266 


5030 


- $6604 


1020 


- $2E67 


5040 


- $1D08 


1030 


- $3866 


5050 


- $C448 


1035 


- $7B0B 


5060 


- $3865 


1040 


- $2B80 


5070 


- $0357 


1050 


- $777A 


5080 


- $8138 


1060 


- $E3BC 


5090 


- $1996 


1070 


- $EBB9 


6000 


- $76B9 


1080 


- $FF3B 


6010 


- $D559 


1090 


- $46DD 


6020 


- $60D6 


1100 


- $4F2D 


6030 


- $3E5D 


5000 


- $CB59 


6040 


- $4D9B 


5010 


- $458A 










Bill Jetzer 





Softkeyfor... 




Science Toolkit \ 




Broderbund 





■ Requirements 

D Super lOB 1.5 

D Sector editor 

D 1 blank disk side for the Master Module 

D 1 blank disk side for each other Module 

A teacher at my school recently asked me 
to copy Broderbund 's Science Toolkit Master 
Module and Module 3: Body Lab. Both disks 
were protected, but I managed to crack them. 

In keeping with the Broderbund tradition, 
the protection was quite good. Both disks' 
epilogues had been changed from DE AAtoDE B6, 
and both disks contained an RWTS routine 
which, when loaded, was located at $9800 as 
opposed to the normal $B8<Z)<Z). The Master 
Module also has a few special surprises— tracks 
$21-$22 aren't formatted and track $01 doesn't 
contain normal sectors. 

To deprotect Module 3, type in the second 
controller at the end of the article and save it. 
Merge it with Super JOB 1.5 and run it. The 
4 sector edits are made to the disk's RWTS. 
Since the RWTS is located at the same place 
on both of the disks I cracked, I am assuming 
that it is located there on all other module disks 
as well and, if so, that the controller should 
work with all other modules. 

Deprotecting the Master Module was a litde 
more involved. I knew that to get the data from 
the abnormal track I had to let the original disk 
do the work. But since the disk wasn't under 
DOS 3.3 or ProDOS, I couldn't make a file out 
of the data that was read in. However, since 
only 5 pages of data were read from the 
abnormal track, and there were 7 sectors free 
on track $(Z)0, 1 simply saved the data in sectors 
$09-0D and modified the code on the boot 
sector to load in the extra sectors. But I'm 
getting ahead of myself. 

I 1 I Type in the controller at the end of the 
article and save it. Merge it with Super lOB 1.5 
and run it. It will copy tracks $00 and $02-20. 
Now comes the hard part— getting the 
abnormal track data off the original and onto 
the copy. Here is the procedure: 

I 2 I Get into the monitor and move the 
ROM boot code in ROM to a lower page of 
memory so that you can modify it: 
CALL-151 
9600<C600.C6Fra 



I 3 I Have the boot code make changes so 
that the page $03 vectors stay intact and the 
program jumps to the monitor after the first four 
pages of data have been read in from track $01 . 
96F8:A9 4C 8D 04 M A9 3C 8D 
97M:0S m A9 08 8D 06 OS A9 
9708:S9 8D 80 08 A9 FF 8D 81 
9710:08 4C 01 08 
9600G put disk in drive before pressing RETURN 



I 4 I Part of the code that was just read in 



is used to read the fifth page of data into 
memory at $800. Install a break point and read 
in the last page: 

100B:00 

lOOOG 

C0E8 turn drive motor off 



I 5 I Move the fifth page of data to the end 
of the first four pages and put the original byte 
back at $100B. 

1400<800.8FFM 
100B:A9 



I 6 I Since you will be able to make as 
many backups as you need, disable the backup 
utility option (which wouldn't work properly 
on the deprotected disk anyway). 

1069:00 
1073:00 



I 7 I The way the sectors are loaded in, the 
first four pages don't need to be relocated when 
the copy is booted. However, the fifth page 
must be moved. To do that, just replace the 
routine that originally read in the fifth page of 
data with a simple move routine. 

ttW-M 00 BD 00 14 9D 00 08 
1108:E8 00 F7 60 



I 8 I Insert a normal DOS 3.3 disk and boot 

it: 

C600G 



I 9 I To get the data onto the copy, type in 
the following program. It uses DOS's RWTS 
routine to write the 5 pages of data onto sectors 
$09-0D. 

300:A0 15 A9 03 20 09 03 EE 
308:1A 03 EE IE 03 AD IE 03 
310:C9 IS DO EC 60 01 60 01 
318:00 00 09 26 03 00 10 00 
320:00 02 00 00 60 01 00 01 
328:EFD8 



I 10 I Insert the copy and execute the write 
routine. 

300G 



I 11 I The hard part is over. Now all that 
remains to be done is perform a few sector 
edits. Start up your sector editor and insert your 
copy. Science Toolkit uses the same type of 
routine as DOS to load in extra sectors during 
the boot process. It is a simple matter to load 
in the extra five sectors: 



Trk Set Byte(s) From 



To 



$00 $00 $62-67 FF 0E 0C 0A 08 0C 0A 08 06 04 
06 FF 



I 12 I Lastly, change the epilogue read 
routines to only check for a DE. This allows 
the copy to read not only from itself, but fix)m 
the originals too. Note that the last four edits 
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are the same edits performed on the extra 
modules disks: 



Trk Set Byte(s) From 


To 


$00 $06 $65-66 EABD 


18 60 


$08 $08 $65-66 EA BD 


18 60 


$0C $09 $38-39 EA BD 


18 60 


$94-95 EABD 


18 60 



All done. Put your originals in a safe place 
(so the students don't play frisbee with them). 
If you have several computers in your lab, you 
can COPYA as many as you like. 

Controller 

1000 REM SCIENCE TOOLKIT 
1010ST=15:LS = 15:CD = WR:FAST=1 

1011 TK = 0:LT=1:GOSUB 1020 

1012 TK = 2:LT = 33: GOSUB 1020: GOTO 1050 
1020 POKE 47426,24: GOSUB 490: GOSUB 610 
1030 POKE 47426,56: GOSUB 490: GOSUB 610: IF 

PEEK (TRK) =LT THEN RETURN 
1040 TK = PEEK (TRK) :ST = PEEK (SCT) : GOTO 1020 
1050 HOME : PRINT "COPY'DONE" : END 

Checksums 



- $356B 1020 - $2B37 

1010 - $88AA 1030 - $3A5B 

1011 - $9C2D 1040 - $AEF4 

1012 - $E95A 1050 - $9E43 



Controller 

1000 REM SC I ENCE TOOLK I T MODULE D I SKS 

1010TK = 0:LT = 35:ST=15:LS = 15:CD = WR:FAST 
= 1 

1020 POKE 47426,24: GOSUB 490: GOSUB 610 :T1 = 
TK:TK = PEEK (TRK) - 1: RESTORE : GOSUB 
310:TK = T1 

1030 POKE 47426,56: GOSUB 490: GOSUB 610: IF 
PEEK (TRK) = LT THEN 1050 

1040 TK = PEEK (TRK) :ST = PEEK (SCT) : GOTO 1020 

1050 HOME : PRINT "COPY'DONE" : END 

5000 DATA 4'CHANGES 

5010 DATA 12,9,56,24 

5020 DATA 12,9,57,96 

5030 DATA 12,9,148,24 

5040 DATA 12,9, 149,96 



Checksums 



- $356B 

- $2544 
1020 - $F082 
1030 - $C09E 
1040 - $FF6C 
1050 - $BB79 



5000 - $4869 

5010 - $31B9 

5020 - $44B0 

5030 - $3E8E 

5040 - $2AA5 



Search command for Apple II's 

This routine will work for any Apple n 
except the enhanced lie or Ilgs. They already 
have their own search routine. 

As you may or may not know, the enhanced 
lie contains a nifty search command in its 
$F80O ROM. Even if you don't have an 
enhanced lie, you can take advantage of this 
26 byte, fully relocatable routine. 

Search Syntax 

Search is called with a monitor c omm and 
of the form HHLL<ADR1.ADR2 dl] in 
which HH is the hi-byte, LL is the lo-byte, 
ADRl is the start of the block you want to 
search and ADR2 is the end of the block. LL 
precedes HH in actual memory . IfH H is $00 
or omitted (LL<ADR1.ADR2 f^ ). then the 
single byte LL is searched for. You cannot 
search for a two byte pair with a high byte of 
$0©. A list of all addresses containing the 
specified pattern is displayed. 

I find it usefiil when trying to locate a string 
of text or a nibble count routine. You'd be 
surprised how valuable such a little program can 
be. To use it, type in the following hex code. 
Since the routine is fiilly relocatable, you can 
type it in at any address; I just used $300 as 
an example: 

399-Mt 01 AS 43 FO M Dl 30 
3«8:O0 OA 88 AS 42 Dl 30 DO 
310:03 20 92 FD 20 BA FC 90 
318:E7 60 

To hook up the program through the jeTj 
vector, put a JMP opcode ($4C) at $3F8, and 
the address (lo byte, hi byte) of the routine at 
$3F9-3FA. For $300, you would type: 
3F8:40 00 03 

I'm sure that once you're used to it, you 
will find many situations where it will come in 
handy. 



Gary Verbuch & Nemoran Pierre 



Zip Chip finally ships 

Yes, the Zip Chip has finally started 
shipping and I was beginning to wonder if it 
was coming by mule. From what I understand, 
there were some problems with the yield after 
a wafer-run ( more bad chips than good ) which 
caused the shipping delay. Being an engineer 
I can understaml the problem and apparently 
everything has been corrected. As a consumer 
I was starting to become impatient. 

Well, the chip Anally arrived and it was 
time to put it thru some testing. If there are any 



problems with the device then I would like to 
know about them now. My main concerns are 
compatibility with available software and 
system hardware, and the actual speed 
improvements 

Installation of the Zip Chip consists of 
removing the 65C02 and replacing it with the 
new processor. A chip removal tool is included 
to avoid any damage in the process. 

For the readers who are not interested in 
the technology behind the Zip Chip, my 
comments and final conclusions are at tiie ewl- 
of this article. 

Zip Technology has developed a 65G02 
processor to run at 4 megahertz with a 16K 
cache memory, whereas the processor in your: 
Apple n, 11+ or lie is clocked at 1 megahertz 
widiout memory caching. If you are unfamiliar 
with the terms memory cache or system clock 
I will briefly cover each term. Since there are 
so many facets to consider when reviewing 
processor caching I've decided not to cover it 
in depth. Instead, I will let the test results be 
the determining factor as to the effectiveness 
on the Apple. 

The microprocessor can be considered the 
heart of the computer while the clock controls, 
it's heartbeat. Ehiring the design process, the 
clock rate is a vital consideration. The original < 
6502 processor was designed to run at 1 
megahertz, although there are now 2 megahertz 
versions. As integrated circuit technology 
improved, the 65C02 was developed. Now the 
processor draws less current, has lO additional 
instructions and can be clocked at 1 or 2 
megahertz. All enhanced Apple He's and 2c 
versions contain this improved 6502. 

Since the clock controls the heartbeat of the 
microprocessor, so to speak, it also determines 
the execution time, in cycles (1 microsecond)',* ' 
of an instruction. The most complex 65<S2 ' 
instruction takes seven clock cycles or 7 
microseconds to execute. One important point 
I would like to make clear at this time is that 
the clock rate is not necessarily the definition 
of a systems speed. For example, I've run 
comparison tests on the 6502 running at 1 
megahertz against the Z80 and the 8©85 
microprocessors clocked at 2 megahertz. Even 
though the Z80 and 8085 are clocked attwice 
the speed of the 6502 the results were 
comparable. A note about the tests, I ran the 
6502 tests on the KIM-1 in early 1978. The 
Z80 system used was the Exidy Sourceror 
which came on the market shortly after the 
original Apple II and the 8085 was an S-lOO 
board distributed by Cromemco. 

Cache memory is relatively new to 
microprocessor based systems. Although there 
are different approaches to caching a system I 
will concentrate on processor caching used by 
the Zip Chip. The Zip Chip contains 16K of 
cache memory which is divided into two 8K 
banks, the Tag cache and the Data cache. Both 
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banks are refered to as fast RAM, where 
interaction between the processor and these two 
banks can be up to four times the access time 
of the RAM external to the microprocessor. 
Remember, the 16K bank is contained on the 
Zip Chip and is not part of Apple's main 
memory. This RAM is available to the 
processor only and cannot be accessed thru 
software. During program execution, the Zip 
Chip polls the tag cache to determine whether 
the data required is in the data cache. Here is 
what is referred to as a cache hit or miss. If 
the data is not present the processor has to slow 
down to normal speed to read main memory and 
is referred to as a cache miss. A cache hit is 
when all the necessary data is contained in the 
data cache and main memory is not referenced. 
The amount of cache hits and misses will 
determine the actual run time of a program. 
Although the actual size of the Zip Chips cache 
is only 16K, it can take advantage of the fact 
that regardless of the type or length of a 
program, there will always be certain portions 
of code which is executed more than others. A 
program that can be contained in the data cache 
will run at Ml qieed because the Zip Chip never 
has to slow down to reference main memory. 

A conmion question at this point is why 
doii't they just clock the whole system at 4 
megahertz and utilize main memory. 
Unfortunately, the Apple was not designed to 
be clocked that fast and would have to be 
redesigned. 

There are six Softswitch registers available 
to the programmer to control certain aspects of 
the Zip Chip. I will include a general 
description of each switch rather than describe 
every bit pattern's effect. 

Address Function 

$(^5A Lock or unlock the Zip Chip. Protect 

configuration changes. 
$C05B A write enables the chip & a read returns 

the current RAM size. Fast or sync mode, 

fast or normal paddle mode and control 

over cache updating. 
JC05C Control speed of slots 1 -7 (fast/normal) 

apd speaker toggle (fast/normal). 
$(^5D Control over cache speed. (1.1111 Mhz 

to 4.0000 Mhz) 
$C05E Read Apple softswitches (control 

synchronous sequences). Also used to 

ensure your code will execute at the system 

speed selected. 
$C05F Control the caching of language card 

memory or bank switched memory cards. 

The Zip Chip comes with a disk containing 
diagnostic and configuration software. The 
configuration program included allows you to 
alter the above switches without writing any 
code. If at any time you would prefer the Apple 
to run at normal speed, pressing ESC 
immediately after a cold or warm start will set 
the Zip Chip to run at 1 megahertz. 



Enough about caching and softswitches, 
lets continue on to software compatibUity. I 
have quite a large collection of software with 
just about every type of program imaginable. 
The easiest approach to ensuring compatibility 
is to simply run the software. After booting up 
and running approximately SO different 
products, I'm convinced that Zip Technology 
left no stones unturned. Quite a few of the 
programs I ran utilize auxiliary memory and 
every graphic mode available on the Apple has 
been accessed. Every program ran without 
incident. There appears to be no problems with 
hardware compatibility either. 

Since some software for the Apple takes 
forever to boot, I'll include a time comparison 
table for a few popular programs. Before I 
continue, the Zip Chip can destroy a disk if you 
try to configure slot 6 faster than normal. IX)S 
uses time critical code that can't be tampered 
with. In most cases, there will still be some 
increases in the boot pfocess or disk access. 
Remember, even during a boot, there is code 
executing in memory. 

I lew/ Zip Chip Standard He 



Appleworks 
World Games 
California Games 



17 seconds 18 seconds 
18.2 seconds 28 seconds 
17.2 seconds 20.2 seconds 



As you can see from the above 
comparisons, disk access is very uiq>redictable. 
If your main concern is to speed up disk I/O 
then the Zip Chip is probably not for you. There 
are disk caching products on the market that 
address that issue. 

Well, so far the Zip Chip is everything Zip 
Technology claims. Although hardware and 
software compatibility are important, speed 
improvement is the reason for purchasing the 
processor. 

At this point it was time to decide what 
method to use to test the Zip Chip's speed. The 
most common benchmarks utilize a couple of 
mathematical approaches, such as the Sieve of 
Eratosthenes or the Fibonacci benchmark. I've 
decided to use Appleworks for two reasons, 
first, I feel the results of one iteration of the 
Sieve or calculating the 24th Fibonacci number 
lOO times would be abstract to some readers 
and second, Appleworks is probably the most 
popular application and the results would be of 
more interest. 

Pierre and I decided to test the Zip Chip 
with a simple Appleworks sort and search. 
Since a standard Apple lie contains only 128K 
of ram we used an Aj^lied Enginering Ram 
card for testing. The Zip Chip is capable of 
caching up to 2 megabytes of auxiUaty memory. 

The database file used contains 1547 
records consisting of 30 fields. Each field used 
for the alphabetic sort contained on an average 
of IS characters and the numerical sort used a 
field with S digits. The text search scanned 
every record for the occurence of a name which 



exists only once within the database. Similar 
tests were run on a spreadsheet containing 181 
names with 28 fields per name. 

The last entry in the table is the results of 
a Ik Applesoft program that calculates and 
displays the hex and binary digits of the decimal 
numbers from O to 25S. 

Time Comparison Tables (in seconds) 

lie lle + Zip llgs 



Data Base fde (129K) 




Alpha sort (A-Z) 10 
(Z-A) 10 

Number sort (0-9) 14.5 
(9-0) 13.6 

Text search 49.9 


3.2 
3.2 
4.2 

4.1 
14.6 


3.3 
3.3 
4.8 
4.8 
18.9 


Spreadsheet file 56K 




Alpha sort (A-Z) 9.5 

(Z-A) 10 

Text search 6.4 


3.0 
3.2 
2.0 


3.3 
3.2 

2.1 


Number Conversion 


program 


151 


66 


70 



Comments 

We did run quite a few other tests, but since 
the results stayed consistent with the above table 
we chose not to include all of them. The Zip 
Chip consistently ran 2 to 3 .S times faster than 
a standard Ue. Speed improvements over the 
ngs were minimal in all tests. 

I originally set aside one piece of paper to 
record any annoyances or problems that occured 
during testing. After two weeks there are only 
two entries on my problem sheet, and both 
entries are very minor annoyances. 

1). During a warm boot ( ICJSBBgTl ) 
you must hold the open apple key down for 
approximately two seconds before the boot is 
actually initialized. 

2). When deprotecting software it is often 
necessary to reset out of the program. Hitting 
ISRESKTI in rapid succession is as effective as 
tapping these keys once. 

Conclusion 

If you want to increase the speed of your 
Apple ne or lie considerably without spending 
the money for an Accelerater card then I highly 
reccommend the Zip Chip. I could not find one 
notable fiaw with the processor and every 
program tested ran considerably faster than 
normal. 

Installation Of the device is simple and can 
be completed in a matter of minutes. Zip 
Technology offers a 30 day money back 
guarantee if not completely satisfied widiin that 
time period. 

For the price of $130.00 you wiU possess 
an Apple with a brand new personality. 
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The 



Ratings 

<!<?<!<?<? SUPERB 

<!^^3<J EXCELLENT 

<J<J^ VERY GOOD 

<J<J GOOD 

^ FAIR 

(S) POOR 

®(i BAD 

dXi)® DEFECTIVE 




■ Requires: 

D 512K Apple Hgs 

D one Vh" drive 

D second drive optional 

No doubt you have been told that inside the 
Hgs are all sorts of nifty Toolbox routines which 
could do wonders for your BASIC/ProDOS 8 
programming, if only they were easier to get 
to! Well the same notion occurred to the people 
at So What Software— as in "so what if you 
are supposed to use ProDOS 16"—; and the 
first result is a super-res text/graphics-to-BASIC 
interface named "Iconix". Now you can load 
and display super-res screens, present messages 
in colored text, and manipulate user-designed 
icons— all, together with mouse point-and-click 
input, without leaving the friendly realms of 
ProDOS 8 and in-ROM BASIC! 

The "Iconix" package consists of a 3 'A" 
diskette on which you find a thirty-plus page 
manual (for on-screen perusal or dumping to 
your printer), assorted editors, icon templates, 
example files, and ICONIX.GS. The latter, a 
mere six blocks in length, is the real workhorse 



of the system and the only file you will need 
to transfer in order to access "Iconix" features. 
Unlike some 'power programming' add-ons, 
ICONIX.GS does not gobble hugh chunks of 
Bank O memory or fill up your applications 
diskettes with accessory files. It DOES insist 
upon being the first Memory Manager client 
(i.e. you can't boot under Diversi Cache) and 
will use about 8.5K in Bank O for buffers. 

Starting with an otherwise blank bootable 
ProDOS 8 diskette, the simplest "Iconix" 
implementation requires ICONIX.GS and a 
BASIC program which, at some point, does a 
"BRUN ICONDC.GS". Using the POKEs and 
CALLs outlined in the manual, you could 
switch the super-res screen on and off, do 
screen clears, create and 'flash' (i.e. invert) 
variously sized color bars, and move/read the 
mouse cursor. Not very interesting; but add 
super-res screens; and viola!, your mouse has 
something to point to and flashing a portion of 
the screen can mean something. An "SHGR 
Bloader" routine in ICONIX.GS lets you load- 
in one or more standard unpacked super-res 
files, one per available memory bank. 
Displaying any loaded screen is then just a 
matter of POKEing its bank number and doing 
a CALL. 

For some applications, ICONIX.GS plus 
a few super-res frames may be all you will need. 
Most programs, however, must be able to 
generate text and at least some graphics 'on the 
fly'; AND, since you're on a Hgs, these might 
as well be in fiill-color super-res! ICONIX.GS 
gets its text font and icons from a special kind 
of super-res screen called an "icon sheet". This 
is a frame having a font set plus up to fourteen 
icons, which you create using any of the popular 
painters, all on a black, (i.e. 'transparent' color 
O) background. This way Toolbox routines can 
'lift off" font characters and pictures fi-om your 
'sheet'. 

The current version of "Iconix" (2.1) is 
very picky about font block location (upper left) 
and character size (8x8 pixels), which explains, 
in part, why a "Blank Master" sheet With text 
font in place is supplied on-diskette. Your 
pictures, on the other hand, can vary widely in 
size and go just about anywhere— a very nice 
feature, since practically any 'clip art' graphic 
becomes an icon candidate. The only catch here 
is that "Iconix" expects the user to tell it, via 
the "Icon Edit" utility, where each icon is to 
be found on the sheet. This entails selecting a 
number identifier from the editor screen; and 
then, on a sheet display, clicking opposite 
comers of the space containing the icon 
picture(s). With the resulting "icon params" 
added, your new icon sheet is ready to be saved 
for future use. 

Once a BASIC program loads in an icon 
sheet and POKEs an "icon bank" pointer, all 
of that sheet's icons are available for pasting, 
moving, flashing, etc. anywhere on the screen. 



even on top of each other! Similarly, text, in 
the on-sheet font and current palette colors, can 
start anywhere. For example: lOO SG$= 
' 'Welcome to Iconix Tester' ' plus a few POKEs 
(to set location and color) and a CALL will 
display the message in the selected color at the 
screen location specified. 

Thanks to an excellent tutorial, you can 
begin using ICONIX.GS in your BASIC 
programs almost inmiediately. On-diskette 
menu and editor utilities are all in BASIC, 
employ ICONIX.GS, and serve as helpful 
examples. In fact, slicing off the unneeded part 
of one such program, as done in the tutorial, 
leaves a kind of 'Blank Master' program. You 
have all the lines you need to start a new 
application; and sticking with the variable 
names defined in the examples (e.g. "DS" for 
the "Display Screen" CALL address, etc.) 
makes it easier to treat the ICONIX.GS 
interface like a set of newly acquired BASIC 
super-res commands. 

So, can you expect 'smooth sailing' in your 
"Iconix" progranmiing experiences? Probably 
not. The culprits here do not include 
ICONIX.GS itself— in the few short programs 
I've written using the interface, everything 
seems to work at least as well as advertised—; 
nor is there any ground for complaint regarding 
nuts-and-bolts docimientation. ITie easy-reading 
manual is well-organized, lists all PEEKs, 
POKEs, and CALLs; and is very good about 
telling the user what does what. Unfortunately, 
once you get past the tutorial, "Iconix" is not 
nearly so effective in addressing the do's and 
don't's, planning, and other concerns relating 
to 'fiill-blown' applications. 

As an example of the above: reading the 
"Iconix" manual, it's easy to get the impression 
that a user has almost complete freedom of 
palette colors selection. Nothing is said about 
the need for palette consistency among icon 
sheets and loaded-in screens; and choice of icon 
sheet background color is treated like a wide- 
open option. That, for some reason, the "Blank 
Master" sheet comes with a white background 
does not, of course, help matters. (Don't forget 
to do a black/color O fill before you start 
painting.) 

Granted, some "Iconix" users will find 
super-res applications development no more 
difficult than using the built-in BASIC hires 
commands, probably a good deal easier. No 
one, however, is likely to get through the on- 
diskette utilities without reaching, instinctively, 
for a can of Black Flag. The worst offenders 
are "Palette Edit", for adjusting colors among 
the sixteen palettes, and "SCB Edit", for 
setting resolution and palette on a line-by-line 
basis. Aside from observing that, as isolated 
functions, such capabilities are virtually useless, 
and that "Palette Edif's controls are glitchy, 
there is the problem that running either utility 
is like rolling dice. Sometimes, a perfectly good 
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picture file will bomb the program; sometimes 
not. Your finished work may be saved; but, 
then again, maybe not; and, if it is saved, there 
is no guarantee that it will be under the file name 
you expect. So much for 'bad news'. The 'good 
news' is that neither utility has a thing to do 
with accessing ICONIX.GS features. Playing 
picture file roulette is entirely optional. 

Working with "Icon Edit", your last step 
in icon sheet preparation is, generally, quick 
(one or two minutes), easy, and even fun. Still, 
tfie program fails to check the limits you click- 
in for each icon (too big, and it bombs); nor 
does it protect itself from the stuff 640-mode 
painters seem to dump into the "unused" 
portion of a picture file (i.e. again, a bomb). 

Depending upon your painter choice, "Icon 
Edit" can also complicate the process of 
revising/adding-to icon sheets. While the utility 
wUl load both PIC ($C1) and BIN type 
unpacked picture files, it always saves sheets 
as type BIN. Among popular painters, only 
"816 Paint" and "Deluxe Paint II" will accept 
BIN files; "The Graphics Studio" and 
"Paintworks Gold" will not. Finally, even 
"Icon Edit" is not 100% reliable when it 
comes to saves; so it's a good idea to save your 
stuff under a new name and do a CATALOG 
before exiting. 

"How did you get a ProDOS 16 program 
to load so fast?!" Admittedly, just such a 
reaction from computer room visitors comes 
close to paying back an investment in So What's 
"Iconix". But, then, you won't need anyone 
to tell you that your program's super-res 
displays and mouse interface have the look and 
feel of a commercial product. Just two 
'warnings': (1) in case you decide to rewrite 
the "Iconix" utilities, expect some competition 
from the programming fanatics at So What. 
Once this review arrives, you can be sure an 
upgrade will be in the works. (2) Working with 
"Iconix" can be as addictive as any game. This 
is one package you can 'get your teeth into'; 
a boon for beginning programmers, and 
positively a feast for veterans! 



The State of Apple Chess 

Since Apple II chess has been in one of its 
periodic doldrums, when Leslie Daley at 
Spinnaker asked if I would like to review 
"Sargon 4" for the Macintosh, there was littie 
hesitation: "Sure, why not?" Plenty of Mac 
users own a n and read Computist. Besides 
which, a look at the new program vis-a-vis 
established chess players running on the Ilgs 
is bound to be of interest. 




by Dan and Kathy Spracklen 
$49.95 Spinnaker 
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■ Requires: 

n Macintosh 
n one VA" drive 

Reaffirming " Sargon 's status as the most 
feature-laden of all personal computer 
opponents", the latest edition offers a variety 
of playing levels (5 seconds through 10 minutes 
per move and "infinite") plus strength modifier 
options to limit search depth, restrict computer 
'blinking time' to its own move, and turn off 
access to the 68,000 position opening 
'library'. Add an eight-level 'all the moves' 
mode (i.e. a player has 5 minutes, ... 3 hours 
to make all of his or her moves in a game) and 
"Sargon 4" delivers practically every 
tournament and 'skittles' setup one could wish 
for. 

A frequent user complaint is that computer 
chess programs don't DO ANYTHING, except, 
of course, make moves. (I have long suspected 
that one of the reasons computers seem to play 
as well as they do is that, at a minute or more 
per move, they bore their human of^nents into 
committing errors.) Well, "Sargon 4" won't 
moan, squirm, or chortle with glee; but its 
"Window on the Search", Score, and search 
tree displays— all on the same screen as the 2-D 
board, move list, and clocks— amount to a fair 
substitute. 

As in football and presidential debates, 
much of the fiin in chess comes from analysis. 
Aside from the expected take-back, change 
sides, hint, game load/save, and mate-finding 
options, "Sargon 4" will let you transfer a 
game's move list to clipboard memory and/or 
obtain a printout. (Unfortunately, there is no 
provision for saving or printout of the actual 
board display.) A flexible Replay mode not only 
permits timed "automatic" or user-stepped 
move advance, but also allows halting at any 
point with an option to continue the game from 
the current position. Along with your own 
games, on diskette Replay candidates include 
over one hundred "Great Games" plus as 
nearly as many problems. 

In an effort to better mimic 'the real thing', 
most Apple chess programs since "Mychess 11" 
have offered a simulated 3-D board display. 
"Sargon 4"s comes with five piece sets, color 
selection (!) on the Mac H, AND a design-your- 
own-set "Sculptor" utility. While it is the best. 



clearest 'real board' simulation yet, I predict 
most players wUl stick with the main screen's 
2-D format, especially since, in 3-D, you lose 
the search and move list displays. 

So much for frills (albeit nice ones); what 
about the 'bottom line'?! Well, according to 
Spinnaker, "Sargon 4 beats Chessmaster 2O0O 
seven out of eight games"- decisive, but not 
altogether surprising since the tests were 
conducted with "Chessmaster 2000" running 
on a He. How, one wonders, would "Sargon 
4" fare against the better II series programs 
running on a Ilgs?! 

After obtaining the loan of a Mac Plus, the 
next problem in setting up the intra-Apple 
confrontation was matching time spent per 
move. Surprisingly, with the Ilgs on its fast 
setting, the divisor into documented 
"Chessmaster 200©" timings was consistently 
around 4.0. In a 51 -move game at Level 10 
("3 min/move"), "Chessmaster 2000" 
actually averaged 42.2 seconds/move; in 
another game at Level 7 ("2 min/move") the 
average was 27.6 seconds/move, ... etc.. I ran 
"Sargon 4" with 'think on opponent's time', 
"Window on Search", and opening library 
features 'ON', because this is the setup most 
players wUl probably want to adopt. The high- 
activity 'show search tree' option was 'OFF'; 
to minimize the cost, in thinking time, of display 
updating. Results of a seven-game mini- 
tournament, are shown below. (Games are in 
the order played.) 

Sargon 4 Chessmaster Winner 



30s/mv W 


L6B 


draw 


30s/mv B 


L6W 


draw 


Im/mv W 


L9B 


draw 


Im/mv B 


LlOW 


Sargon 


Im/mv W 


LlOB 


CM 


30s/mv W 


L7B 


CM 


30s/mv B 


L7 W 


Sargon 



Result: Sargon 3.5 / CM 3.5 

Anticipating that fans of other n series 
programs might feel left out, I also tried 
"Sargon III" and "Mychess H" against 
"Sargon 4" at 1 min/move. (Since "Colossus 
IV" does not run properly on the Ilgs, it was 
disqualified.) At Level 5, "Sargon HI" just 
about matches "Sargon 4"s speed, but not its 
smarts. (Evidently, the claimed "new 
algorithms" work.) Playing white, "Sargon4" 
triumphed after a hard-fought contest. 
"Mychess n", at Level 7, averages a few 
seconds below a minute per move. In two tight 
games, the results were even, with white 
winning in each case. 

Naturally, as a Ilgs partisan, I would like 
to read the above as solid evidence that the 
current best in Hgs-compatible chess is the equal 
of Mac's best chess player. I would, except that 
experience playing each of the programs has 
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convinced me that 'it just ain't so*. Granted, 
"Sargon 4" isn't going to overwhelm 
"ChessmasterlOOO" or "Mychess H"; but, 
it is noticeably the toughest opponent. A 
tournament-player friend (USCF "A" rated) 
came to the same conclusion. Predictably, best 
at tactics and a tad weak in positional play, 
"Sargon 4" does, nevertheless, seem to play 
a more integrated, 'human-like' game than, for 
example, "Chessmaster 2O0O". The higher 
the level, especially around, 'tournament speed' 
settings, the less 'computer like', more 
entertaining its play becomes. Clearly, if you 
ovm a Mac, you're in luck. For now, tfie BEST 
in Apple chess is "Sargon 4". 

FAST FRABfES, UPDATES, ETC. 

Electing a President 

There you are, digging around in your 
software stores for the perfect Election Night 
Party 'ice breaker' when suddenly you 
remember that neat new game. ' 'Wow, just the 
thing!", you exclaim, "Boy am I glad I read 
Computist!" ... Hopefully, you will have 
already given SSI's "President Elect: 1988" 
($24.95, for 48K Apple H series) a thorough 
tryout. The game is a cinch to get into, with 
an experienced player to explain things; but 
starting out with just the manual (i.e. becoming 
the 'experienced player') takes a bit of practice. 

Whether you choose candidates from the 
70-plus politician data base or create your own, 
you're in for a realistic campaign-through- 
election simulation including debates, trips, 
advertising, poUs, and 'strong/weak/toss-up' 
electoral maps— all culminating in dramatic 
east-to-west election night returns. For 1-3 
players, any or all of which may be computer- 
directed, "President Elect'" can even run 'the 
whole show' and predict the election's outcome! 
(Incidentally, SSI has recently published 
updated Dukakis parms. When you get the 
game, enter Inflation 4%, Unemployment 
5.3%, GNP 3.1%, Peace, Morale 5.5, Item 
Ratings: 7,7,7,2,7,7,6,5,8,6,9, 1 ,8, 1 ,7,7,3,8, 1 . 
Speaking 5, Magnetism 5, Poise 9.) 

VENDORS 

So What Software: 10221 Slater Avenue, 

Suite 103 Fountain Valley, CA 92708 

(714-964-4298) 

Splnnalcer: One Kendall Square, Cambridge, 

MA 02139, (617-494-1200) 

Strategic Simulations inc.: 1046 North 

Rengstorff Ave., Mountain View, CA 94043 

(415-964-1353) 



i 



The folhwing readers contributed additional 
data to the Uftima V Attributes and Itena chart 
on page 31. Vincent Andrews, Robert Kettk, Dr. 
Jiean-Louis Torre and Bfain Johnson. Mike Norton 
did tiK actual work of combining the data and 
updating the chart. RTXXed 



Robert Kettle 



Playing Tips for.. 



Ultima V 

Origin 



Totally by accident I found a command not 
listed in the manuals that I have found to be of 
great assistance in playing this adventure, it is 
the Ctrl-® command. This conunand will 
present you with a large multidigit number, of 
which the last four digits are your coordinates 
on the current map, be it in the kingdom of 
Britannia or a small village. This makes finding 
your way hack to those special locations just 
a little bit easier. 

A.P.T.for... 



Ultima V 

Origin 



Note that for the items on block $01D (FO- 
FC) to be present in your inventory you must 
enter a value of $FF, with the exception of Skull 
Keys for which you enter a hex value equal to 
the number of Skull Keys desired. 



Dr. Jean-Louis Torre 



A.P.T.for... 



Ultima V 

Origin 



When you visit houses, refrain from taking 
the easy to get food lying on the tables. 
Remember the old saying "It is too good to be 
true"? Well, it is. You will loose your... virtue! 



Biain Johnson 



A.P.T.for... 



Ultima V 

Origin 



The tip in COMPUTIST #56 on page 19 
that states: you must fight a shadowlord if you 
enter Jhelom, is not always true. If you enter 
a towne and you get a message that an air of 
hatred, cowaidice, ot falsehood surrounds you, 
the towne is not safe. This happens because 
your character is not doing well on the virtue 
which is associated with that towne. (Look in 
the Book of Lore at the towne descriptions.) 

To enter safely, you must go to the shrine 
which corresponds to the towne and meditate. 
You can enter an unsafe towne, but you must 



avoid the shadowlord. If you get too close, he 
wUl attack and, most likely, kill your whole 
party. 

Other notes: 

Attributes: The status byte is: 00-In party, 7F- 
gone, FF-not in party. Any other number 
denotes the city they are being 'kept* in (where 
you leave a member). 

Level: The optimum level is 8. Even though 
a character's level can be $99, this makes battle 
much harder. Fighting accuracy is terrible and 
the monsters get 5-6 turns to your 1 mm. 
Clocli/calendar: Numbers are entered in BCD 
(binary coded decimal). (Example: month 11 
= $11.) 

Playing Tips for... 



Ultima V 

Origin 



If you look at any door handle and you see 
a small dot underneath the door, it is locked. 
If you cannot see the dot, the door is unlocked. 
If you have a color monitor, the fringe around 
the dot will be either purple or green. If it is 
purple, normal keys can unlock Ae door. If the 
fringe is green, you must use skull keys. Two 
places skull keys are needed are Lord British's 
Chamber and the tower in Skara Brae. If you 
change floors (stairs & ladders), or are attacked, 
all doors are changed to their original state. 

(^ I have spent many hours trying to 
deprotect Flight Simulator with no luck. I have 
purchased COMPUTIST #36, #45, and #51. It 
would seem that was all I needed... Wrong. 
After following the instructions exactly for the 
third time, I decided to look at the booting code 
to see if it might be an error I could fix. After 
looking at the additional code from $869-$8Fl 
added by Christopher Dean (#51), I modified 
it so it copied the whole F8 ROM onto the 
language card instead of just pages $FC, $FD, 
and $FE. This allowed the disk to boot further, 
but not much ftirther. After the program 
recalibrated the disk arm for the first time, it 
would load part of the graphic screen with 
garbage, change to the text screen, print "22 
1D35", and then fi-eeze. I snooped around a 
little and found that the garbage on the graphic 
screen was the simulator's DOS. I searched and 
searched but could not find out why it loaded 
the simulator's DOS in that area of memory. 
Could anyone help me out. 

CS) I also have had trouble trying to 
get a working copy of my Olympic Decathlon 
(#35). The whole procedure works fine and the 
disk will boot up to the point where you are 
asked if you want to begin. If the program tries 
disk access, it freezes. One other thing I don't 
understand is while booting, after the screen has 
turned blue, parts of the screen are blacked out. 
That doesn't happen with the original. 
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COMPUnST #61 



NovsmlMr 



Ultima V Character data (Block $01D, bytes $80-17F / Track $03, sector J 


iOS, bytes $80-FF and sector $04, bytes $00-7F) 


name 


ptayer 


ShmiM 


lolo 


Mariah 


Geoffrey 


Jaana 


Julia 


Dopre 


status 


$80 


$90 


$A0 


$B0 


$C0 


$D0 


$E0 


$F0 


sex 


$81 


$91 


$A1 


$B1 


$C1 


$D1 


$E1 


$F1 


class 


$82 


$92 


$A2 


$B2 


$C2 


$D2 


$E2 


$F2 


health 


$83 


$93 


$A3 


$B3 


$C3 


$D3 


$E3 


$F3 


strength 


$84 


$94 


$A4 


$B4 


$C4 


$D4 


$E4 


$F4 


intel 1 igence 


$85 


$95 


$A5 


$B5 


$C5 


$D5 


$E5 


$F5 


dexterity 


$86 


$96 


$A6 


$B6 


$C6 


$D6 


$E6 


$F6 


magic points 


$87 


$97 


$A7 


$B7 


$C7 


$D7 


$E7 


$F7 


current hit points 


$88-$89 


$98-$99 


$A8-$A9 


$B8-$B9 


$C8-$C9 


$D8-$D9 


$E8-$E9 


$F8-$F9 


maximum hit points 


$8A-$8B 


$9A-$9B 


$AA-$AB 


$BA-$BB 


$CA-$CB 


$DA-$DB 


$EA-$EB 


$FA-$FB 


experience points 


$8C-$8D 


$9C-$9D 


$AC-$AD 


$BC-$BD 


$CC-$CD 


$DC-$DD 


$EC-$ED 


$FC-$FD 


experience level 


$8E 


$9E 


$AE 


$BE 


$CE 


$DE 


$EE 


$FE 


name 


Katrina 


Sentri 


Gwenin 


Johne 


Gorn 


MaxweU 


Toshi 


Sadui 


status 


$100 


$110 


$120 


$130 


$140 


$150 


$160 


$170 


sex 


$101 


$111 


$121 


$131 


$141 


$151 


$161 


$171 


class 


$102 


$112 


$122 


$132 


$142 


$152 


$162 


$172 


health 


$103 


$113 


$123 


$133 


$143 


$153 


$163 


$173 


strength 


$104 


$114 


$124 


$134 


$120 


$154 


$164 


$174 


intel 1 igence 


$105 


$115 


$125 


$135 


$145 


$155 


$165 


$175 


dexterity 


$106 


$116 


$126 


$136 


$146 


$156 


$166 


$176 


magic points 


$107 


$117 


$127 


$137 


$147 


$157 


$167 


$177 


current hit points 


$108-$109 


$118-$119 


$128-$129 


$138-$139 


$148-$ 149 


$158-$ 159 


$168-$169 


$178-$ 179 


maximum hit points 


$10A-$10B 


$11A-$11B 


$12A-$12B 


$13A-$13B 


$14A-$14B 


$15A-$15B 


$16A-$16B 


$17A-$17B 


experience points 


$10C-$10D 


$11C-$11D 


$12C-$12D 


$13C-$13D 


$14C-$14D 


$15C-$15D 


$16C-$16D 


$17C-$17D 


experience level 


$10E 


$11E 


$12E 


$13E 


$14E 


$15E 


$16E 


$17E 



(Block $01D, bytes $180-1FF / Track $03, sector $04), bytes $80-FF 



Sex: male-$3E, female -$3F 


$180-181 food 


(0-9999) 


$1F0 shard of falsehood 


(00/FF) 


$1F7 skull keys (0-99) 


Status: not present - $FF, gone - 


$182-183 


gold 


(0-9999) 


$1FI shard of hatred 


(00/FF) 


$1F8 Lord Brit ish's amulet (00/FF) 


$7F, present -$00 


$184 


keys 


(0-99) 


$1F2 shard of cowardice 


(00/FF) 


$1F9 Lord Brit ish's crown (00/FF) 


Health: good - $C7 , po i soned - $D0 


$185 


gems 


(0-99) 


$1F3 spyglass 


(00/FF) 


$1FA Lord Brit ish's sceptre (00/FF) 


dead-$C4, sleeping-$D3 


$186 


torches 


(0-99) 


$1F4HMS Cape plans 


(00/FF) 


$1FB black badge (00/FF) 


Class: avatar - $C1, bard - $C2, 


$187 


grappling hook 


(0-1) 


$1F5 sextants 


(00/FF) 


$1FC wooden box (00/FF) 


fighter -$C6, mage-$CD 


$188 


magic carpets 


(??) 


$1F6 pocket watch 


(00/FF) 





(Block $01F / Track $03, sector $01) 



Armour 

00 Leather Helm 

01 Chain Coif 

02 Iron Helm 

03 Spiked Helm 

04 Small Shield 

05 Large Shield 

06 Spiked Shield 

07 Magic Shield 

08 Jeweled Shield 

09 Cloth 
0A Leather 
0B Ring 
0C Scale 
0D Cha I n 
0E Plate 

0F Mystic Armor 

Weapons 

10 Dagger 

11 Sling 

12 Club 

13 Flaming Oi I 

14 Main Gauche 

15 Spear 

16 Throwing Axe 

17 Short Sword 

18 Mace 

19 Morning Star 
lA Bow 



IB Arrows 

IC Crossbow 

ID Quarrels 

IE Long Sword 

IF 2-Handed Hammer 

20 2-Handed Axe 

21 2-Handed Sword 

22 Halberd 

23 Chaos Sword 

24 Magic Bow 

25 Si Iver Sword 

26 Magic Axe 

27 Glass Sword 

28 Jeweled Sword 

29 Mystic Sword 

Magk items 

2A Ring of Invisibi I ity 
2B Ring of Protection 
2C Ring of Regeneration 
2D Amulet of Turning 
2E Spiked Collar 
2F Ankh 



light 

magic missile 

awaken 

cure poison 

heat 

disintegrate objects 



40 In Lor 

41 GravPor 

42 An Zu 

43 An Nox 

44 Man I 

45 An Y I em 



46 An Sanct 

47 An Xen Corp 

48 Rel Hur 

49 InWis 
4A Kal Xen 
4B In Xen Man I 
4C Vas Lor 
4D Vas F I am 
4E In FlamGrav 
4F InNoxGrav 

50 InZuGrav 

51 InPor 

52 An Grav 

53 In Sanct 

54 In Sanct Grav 

55 Uus Por 

56 Des Por 

57 WisQuas 

58 I n Bet Xen 

59 An Ex Por 
5A In Ex Por 
5B Vas Man I 
5C InZu 
5D Re I Tym 
5E InVasPorVlem 
5F QuasAnWi 

60 I n An 

61 WisAnYlem 

62 An Xen Ex 



unhcli 

repel mutead 

wind change 

locate 

call animal 

create creature life 

great light 

ball (^flames 

wall of fire 

wall of poison 

wall of sleep 

bUiA 

dispell field 

protection 

protection field 

upward move 

downward move 

reveal 

insea swarm 

magic toA 

magic unlod 

great heal 

sleep 

quickness 

tremor 

confiise 

negate magic 

x-ro) 

chttrm 



63 Re I Xen Bet change creature small 



64 Sanct Lor 

65 Xen Corp 

66 InQuasXen 

67 InQuasWIs 

68 In Nox Hur 

69 InQuasCorp 
6A In Man I Corp 
6B Kal Xen Corp 

6C In Vas Grav Corp 
60 In Flam Hur 
6E Vas Rel Por 
6F An Tym 

Scrolls 

70 VL 

71 RH 

72 IS 

73 lA 

74 IFW 

75 KXC 

76 IMC 

77 AT 

Potiois 

78 Blue 

79 Yellow 
7A Red 

7B Green 
7C Orange 
7D Purple 
7E Black 



invisibility 

lall 

clone 

peer 

poison wind 

fear 

resurrect 

summon 

cone of energy 

flame wind 

gate travel 

^mtstop 

great light 

wind change 

protection 

negate magic 

peer 

sunmon 

resurrect 

time slop 

awaken 

heal 

cure 

poison 

sleep 

change shape 



7F White 
Moonstones 

90 1st phase 

91 2nd phase 

92 3rd phase 

93 4th phase 

94 5th phase 

95 6th phase 

96 7th phase 

97 8th phase 



moonstone 
moonstone 
moonstone 
moonstone 
moonstone 
moonstone 
moonstone 
moonstone 



Spefl Ingmfients 

A0 Sulfur Ash 
Al Ginseng 
A2 Garlic 
A3 Spider Si Ik 
A4 Blood Moss 
AS Black Pearl 
A6 Nightshade 
A7 Mandrake 



(0-99) 
(0-99) 
(0-99) 
(0-99) 
(0-99) 
(0-99) 
(0-99) 
(0-99) 



Track $03, sector $07 

00 X-Coordlnate 

01 Y-Coordinate 
lA-lB Year (0000-9999) 
IC Month 

ID Day 
IE Hours 
IF Minutes 



November 
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Bard's Tale III - Combined Attributes and Items List 



9 ^ 








03-Hobbit, 04-l/2-Ei{ 05-1/2-Or:, 06^nonie 


•fc This page IS the result of the combined efforts 


?R 


AR 


Sex : 00-Male 01-Female 


of nomas Rapheld, Brian Symonds, Harold Day, 
Bob Igo and Donald Jones. RDEXed 


2C 


AC 


Character's Picture: (Missing 










sequential numbers are blank pictures) 










00 = Refugee Camp, 01 = Viper, 02 = 


00-0F 80-8F Name of Character 






Hobgoblin, 03 = Lizaid, 04 = White Dog, 


10 90 


Strength 






05 = Red Devil, 06 = Imp, 08 = Serpent, 


11 91 


Intelligence (IQ) 






09 = Nomad, 0C = Dinosaur, 13 = Wear 


12 92 


Dexterity 






Tiger, 15 = Fish Man, 19 = Lizard Priest, 


13 93 


Constitution 






lA = DarkGnonie, lE = BugMan, 1F = 


14 94 


Luck 






Giant, 20 = King on Throne, 21 = Blood 


15-18 95-98 Experience 






Knight, 24 = Skeleton, 26 = Wizard, 27 = 


19-lC 99-9C Gold 






Mage, 28 = Ghost Armor, 2C = Lizaid 


ID-IE 9D-9E Current Level 






Mage, 2E = Tree /w Falling Apples, 2F = 


lF-20 9F-A0 Max Level Attained 






Old Man, 30 = Female Warrior, 31 = Robed 


21-22 A1-A2 Hit Points 






Priest, 32 = Empty Building, 34 = Treasure, 


23-24 A3-A4 Condition 






36 = Sorcerer, 37 = Female Mage, 38 = 


25-26 A5-A6 Current Spell Points 






Shore Line, 39 = Avenging Angel, 3D = Red 


27-28 A7-A8 Max Spell Points 






Dragon, 45 = Study, 46 = Rock Elephant, 


29 A9 


Class: OO-Warrior.Ol-Wizard, 
02-Sorcerer, 03-Conjurer, (M-Magiciai, 






4A = Dead Old Man, 4E = Floating Eye, 53 
= Bartender 




05-Rogue, 06-Baixl, 07-Paladin, 08-HuMer, 


2D 


AD 


Hea 1 th : OCWjood, 01-Poisoned, 02-Old, 




09-Moiik, OA-Aichmage, OB-Chronomancer, 






03-poisoned, 04Klead, 05-dead and go to 




OC-Geomancer, 0D-Monster, OE-Dlusion 








2A AA 


Race : OO-Human, 01-Elf, C2-Dwarf, 


2E 


AE 


??????? 



2F AF Armor Class: lowers the initial armor 
class of die character before normal armor is 
worn. 

30-53 B0-D3 Items carried: the 12 items that each 
character can carry are stored in groups of 
three bytes with the first byte meaning 
unequii^ ($00), equipped ($01), can't use 
($02), or special characteristics (for example 
$08 means die enchanted water of life), the 
second byte giving die item itself, and the third 
byte giving die number of tunes the item can 
be used. 

54-55 D4-D5 Conjurer Spel Is 

56-57 D6-D7 Mage Spel Is 

58-59 D8-D9 Sorcerer Spel Is 

5A-5B DA-DB Wizard Spel Is 

5C-5D DC-DD ArchmageSpel Is 

5E-60 DE-E0 ChronomancerSpells 

61-62 E1-E2 GeomancerSpells 

63-64 E3-E4 Misc. Spells 

64 E4 Critical Hits (Hunter) 

64-65 E4-E5 Bard's Songs 

64-66 E4-E6 Thief Abil ities 

67-68 E7-E8 ? 

69 E9 Multiple Attacks: critical hits modifier 



00 Empty Pockets 

01 Torch 

02 Lamp 

03 Broadsword 

04 Shortsword 

05 Dagge r 

06 War Axe 

07 Ha I bard 

08 Long Bow 

09 Staff 
0A Buckler 

0B Tower Shield 

00 Leather Armor 

00 Cha I n Ma 11 

0E Scale Armor 

0F Plate Armor 

10 Robes 

11 Helm 

12 Leather Gloves 

13 Gauntlets 

14 Mandolin 

15 Spear 

16 Arrows 

17 Mthr Sword 

18 MthrShield 

19 Mthr Chain 
lA Mthr Scale 
IB Giant Fgn 

10 Mthr Bracers 

ID Bardsword 

IE Fire Horn 

IF Litewand 

20 Mthr Dagger 

21 Mthr Helm 

22 Mthr Gloves 

23 Mthr Axe 

24 Shuriken 

25 Mthr Plate 

26 Molten Fgn 

27 Spell Spear 

28 Shield Ring 



29 Fin'sFlute 
2A Kael's Axe 
2B Mthr Arrows 
20 Dayblade 

2D Shield Staff 

2E ElfOloak 

2F Hawkblade 

30 Admt Sword 

31 Admt Shield 

32 Admt Helm 

33 Admt G I oves 

34 Pureblade 

35 Boomerang 

36 All's Carpet 

37 Luckshleld 

38 Dozer Fgn 

39 Admt Oha i n 
3A Death Stars 
3B Admt PI ate #0 
30 Admt Bracers 
3D Slayer Fgn 
3E PureShield 
3F Mage Staff 

40 War Staff 

41 Thief Dagger 

42 Soul Mace 

43 Ogrewand 

44 Kato's Bracer 

45 Sorcer Staff #0 

46 Gait's Flute 

47 Frost Horn 

48 Ag's Arrows 

49 Dmnd Sh i e I d 
4A Bard Bow 

4B Dmnd Helm 

40 Elf Boots 

4D Vanquisher Fgn 

4E Oonjurstaff 

4F Staff of Lor #0 

50 Flame Sword 

51 Powerstaff 



52 Breath Ring 

53 Dragonshield 

54 Dmnd Plate 

55 Wargloves 

56 WIzhelm 

57 Dragonwand 

58 Deathring 

59 Crystal Sword #0 
5A Speedboots 

5B Flame Horn 

50 Zen A rows 

5D Deathdrum 

5E Pipes of Pan 

5F Power Ring 

60 Song Axe 

61 TrickBrick 

62 Dragon Fgn 

63 Mage Fgn #0 

64 Troll Ring 

65 Aram's Knife 

66 Angra'sEye 

67 herb Fgn 

68 Master Wand 

69 Brothers Fgn 
6A Dynamite 

6B Thor's Hainner 

60 Stoneblade 

6D Holy Handgrenade 

6E Masterkey 

6F HaspinRing 

70 Crystal Lens 

71 Smokey Lens 

72 Black Lens 

73 Sphere of Lanati 

74 Wand of Power 

75 Acorn 

76 Wineskin 

77 Nightspear#0 

78 Tslotha'sHead 

79 Tslotha'sHeart 
7A Arefolia 



7B Valarian's Bow 

70 Arws of Life 

7D Canteen 

7E Titan Plate 

7F TitanShleld 

80 Titan Helm 

81 Fire Spear #0 

82 Willow Flute 

83 Firebrand 

84 Holy Sword 

85 Wand of Fury 

86 Lightstar 

87 Crown of Truth 

88 Belt of Alliria 

89 Crystal Key 
8A TaoRing 

8B Stealth Arrows #0 

80 Ye I low Staff 

8D Steady Eye 

8E OlvlneHalbard 

8F Incense 

90 l-ching 

91 White Rose 

92 Blue Rose 

93 Red Rose 

94 Ye I low Rose 

95 RalnbowRose #0 

96 Magic Triangle 

97 X 

98 Hammer of Wrath 

99 Ferof ist'sHelm 
9A X 

9B X 

90 Helmof Justice 

90 Sceaclu's Cloak 

9E Shade lance 

9F Black's Arrows #0 

A0 Werra's Shield 

Al Strifespear 

A2 Sheetmus i c 

A3 Right Key 



A4 Left Key 

A5 Lever 

A6 Nut 

A7 Bolt#0 

A8 Spanner 

A9 Shadowlock 

AA Shadow Door 

AB Miserlcorde 

AC Holy Avenger 

AD Shadowshiv 

AE Kal i 'sGarrote 

AF F I ame Kn i f e 

60 Red Stiletto 

Bl Heartseeker 

B2 x#0 

B3 X 

B4 X 

B5 Dmnd Scale 

B6 Holy TNT 

B7 Eternal Torch 

B8 Oscon's Staff 

B9 Angel's Ring 

BA Deathhorn 

BB Staff of Mangor 

BO TeslaRing 

BD Dmnd Bracers m 

BE Death Fgn 

BF Thunder Sword 

00 Poison Dagger 

01 Spark Blade 

02 Ga I van i c Oboe 

03 Hamon i c Gem 

04 TungShield 

05 Tung Plate 

06 MinstrelsGloves 

07 Hunters Oloak 

08 Death Hainner #0 

09 Blood Mesh Robe 
OA Soothing Balm 
06 Mages Oloak 

00 Fam i I i a r Fgn 



00 Hourglass 

OE Th i eves Hood 

OF Surehand Amulet 

00 Thieves Dart 

01 Shrill Flute 

02 Angel's Harp 

03 The Book #0 

04 Troth Lance 

05 Dmnd Suit 

06 Dmnd Flail 

07 Purple Heart 

08 Titan Bracers 

09 Eelskin Tunic 
DA Sorcerer's Hood 
06 Dmnd Staff 

00 Crystal Gem 

DO Wand of Force 

DE 01 i Lyre#0 

OF Youth Potion 

E0 X 

El X 

E2 X 

E3 X 

E4 X 

E5 X 

E6 X 

E7 X 

E8 X 

E9 x#0 

EA-EF X 

F0 Mthr Suit 

Fl TitanSuit 

F2 Mages Gloves 

F3 Flare Crystal 

F4 HolyMisslle#0 

F5 God's Blade 

F6 Hunter Blade 

F7 Staff of Gods 

F8 Horn of Gods 

F9-FE X 

FF x#0 
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COMPUnST fH\ 



November 



Donald Jones 



A.P.T.for.. 



Bard's Tale HI 

Electronic Arts 



The characters are saved on the last two 
tracks ($21-22). A text search will reveal where 
your character is on the disk. 

Is your Mage still looking for the three 
miscellaneous spells? Just input a 3F 80 for 
bytes $63-64 ($E3-E4). When you start 
changing your warrior's into Geomancer's and 
you want all the spells (including the misc.), 
use FF for the bytes. With your magic user's 
change aU to FF to receive max spells. To 
become a Chronomancer, put FF's in bytes 
$5E-60 ($DE-EO). If you want an Archmage 
with no Chronomancer spells, put FE at $5D 
($DD). 

Some of the abilities are stored at the same 
locations depending on what class your 
character is. For example; the Thieves abilities 
are stored at bytes $64-65-66, whereas the 
Bard's songs are stored at bytes $64-65. These 
are also the locations for tlie miscellaneous 
spells for all magic users. 

C2) A challenge for you graphics 
people. Can you find a way to make your own 
picture and store it to the character disk? The 
article in COMPUTIST #53 by Greg Poulos 
might give you a clue. It tells how to use 
E.O.A. RWTS. The pictures available for your 
characters are limited. For example they only 
give two types of Females to use. It would be 
nice to personalize the game a little more. 

<2) How do I convert an AppleWorks 
file to a standard DOS 3.3 text file! I've always 
used AW to do all my proccesing, and I was 
woundering if there was a way to convert them. 
In addition has anybody been able to sector 
edit 'WINGS OF FURY'? I would like to rig 
it like 'RESQUE RAIDERS'. 



Jim S. Hart 



Softkey for... 



The Calculus Toolkit 

Addison-Wesley 



■ Requirements 

D A blank disk for each Toolkit disk 

D Standard disk copy program 

n A DOS 3.3 initialized disk with no hello 

program 
D A fast DOS, such as Diversi-DOS or Pronto 

DOS (optional) 



You can copy any of the disks in the 
Calculus Toolkit series with a standard disk 
copier such as COPY A. However, when you 
try to boot the copied disk, it hangs and tells 
you that you had a copy protection error. This 
hangup and message comes right after the 
BASIC prompt appears so the protection 
scheme or call to a scheme must be ui the 
HELLO program. Loading the HELLO 
program and listing it reveals that it BLOADs 
a file called 'C, does a few POKEs, and then 
executes a USR function. The rest of the 
program is gibberish. Hmmmm. The 'C file 
must contain the decoding routine and probably 
also contains the copy protection scheme. Going 
into the monitor, BLOADing the 'C file, and 
then checking $AA72.AA73 (starting address 
of a binary file) and $AA6©. AA61 (length of 
a binary file), I found 00 60 at $AA72.AA73. 
I did a 60OOL to take a look at the beginning 
of the code. Here is the disassembly you will 
find on DISK 1, DISK2, DISK3, and DISK4: 

LDA #$FF setRUNjkg 

STA $D6 

LDA #$00 

STA m?2 set up RESET vector 

LDA #$60 

STA $03F3 

JSR i6l3\ to protection scheme 

LDA $01 is this an original? 

CMP #$00 

BNE imBm.goboni 

JSR $605F decode routine 

RTS go back to Appksoft 

JSR $60F5 print message & bomb 



A9FF 
6002 85 D6 
6004 A9 00 
6006 8D F2 03 
6009 A9 60 
600B 8D F3 03 
600E 20 31 61 
6011 A5 01 
6013 C9 00 
6015 D0 04 
6017 20 5F 60 
601A 60 
601B 20 F5 60 



Look around $6 1 3 1 if you want to see some 
genuine signature check code. What I did was 
to remove the call to the protection and to load 
memory location $01 with a 00 if case any 
more checks were made down the road. The 
changes to make are: 

600E EA EA EA NOP 
6011 A9 00 LDA #$00 
6013 85 01 STA $01 

I then BSAVEd the file back to disk using 
the values I found and the disk was deprotected! 

I 1 I Copy the Calculus Toolkit disks onto 
the blank disks using the whole disk copier. 

I 2 I Boot the blank initialized DOS 3.3 
disk. Insert a copied toolkit disk from step 1 . 

CALL -151 enter monitor 

BLOADC 

600E.6014 verify 20 31 61 AS 01 C9 00 

600E:EA EA EA A9 00 85 01 and modify 

BSAVE C,A$6000,L$1E4 



m Repeat step 2 for DISKl, DISK2, 
DISK3, and DISK4. 



Toolkit". Change the modify in step 2 to 
600E:EA EA EA A9 OO and deprotect this 
disk too. 

You're done! 

Put a deprotected "Where in 

Europe is Carmen Sandiego" 

onto a ZVi" disk 

■ Requirements 

D Deprotected Where in Europe is Carmen 

Sandiego disk (2 sides) 
D 3'^" disk 

D ProDOS Copy n Plus (versions 6-up) 
D Disk with the BASIC.SYSTEM system file 

on it 

I recently had the chance to play a 
deprotected version of Where in Europe is 
Carmen Sandiego over at a friend's house. It 
continues the Carmen Sandiego tradition of fun 
with learning. I noticed that the disk was 
ProDOS based and came on both sides of a 5 W " 
floppy disk. My friend has a Ilgs with a 3 'A" 
disk drive and her young children use it alot. 
I thought to myself, "Why not fix the program 
so that it would run off of a 3 'A" disk so the 
kids wouldn't have to worry about whether or 
not they put the correct side in?" After an hour 
or so of seeing what was on both sides, I came 
up with this procedure. 



I 1 I Boot Copy n Plus. 

I 2 I Format the 3 V4 " disk with a dummy 
name of "/DUMMY". 



I 3 I Copy the ProDOS system file from 
your Copy n Plus disk to the newly formatted 
3'/2" disk. 



I 4 I Now copy all of the files except 
PRODOS from the Where in Europe is Carmen 
Sandiego disk to the 3Vi" disk. 

I 5 I Create a subdirectory on the 3 'A "disk 
with the name "SIDE.2". 



I 4 I The fifth disk in the toolkit is called 
"A Calculus Student's Microcomputer 



I 6 I Copy the DATA file from the second 
side of the Carmen disk into the newly created 
subdirectory "SIDE.2". 

Now we need to change the pathnames 
within the Carmen program to look for the 
DATA program in the subdirectory SIDE.2 
instead of the disk named /SIDE2. TTiis allows 
the DATA file to be on the same disk as the 
main program. 

m Get into BASIC from ProDOS 
(execute the BASIC.SYSTEM file, in other 
words). 

I 8 I Insert the 3%" disk into a drive. 

RENAME /DUMH7,/CARMEN.EUR0PE 
BLOAD B,A$1B00 
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CAU-151 
1D34.1D38 
1D34:73 S8 64 6S 2E 
BSAVEB 



verify 2F 73 69 64 & 
and modify 



Note: If the bytes did not match, then use 
a block editor to search for 2F 73 69 54 65 and 
change to 73 69 64 65 2E. 

Now you can use the 3 '/4 " disk to play the 
game and never have to flip disks over again 
for it. A side benefit is that the program loads 
quicker (especially if you have DSR's Diversi- 
Cache installed). 



Softkeyfor... 




■ Requirements 

a 1 blank disk 
D COPYA 
n Sector editor 

D COMPUTIST #57 (for reference only) 
D Bag of Tricks (if you want to speed up the 
loading of the game) 

Spiderbot, another in the Maxx Out series 
from Epyx, is an interesting little game in which 
you, the spiderbot, have to collect parts of 
yourself ai^ ensnare a variety of baddies using 
your spider webs. Overall it is an OK game, 
but it is not up to the standards that it's 
predecessor, Deathsword, established. 

The protection here is essentially the same 
as other recent Epyx releases. I refer you to my 
softkey for Boulderdash Construction Set which 
aH)eared in COMPUTIST #57 (pp. 17-20) for 
a more thorough explanation of the protection 
scheme. It has been slighdy altered here, in that 
zero page locations $F8-$FF are used instead 
of $FO-$F7. Also, the values to put into these 
locations are in a different order and the location 
to jump to after loading the correct values is 
slightly different. Aside from those few 
changes, the rest of the softkey is the same. 

I 1 I Boot your DOS 3.3 system disk. 

I 2 I Tell DOS to ignore checksum and 
epilog errors and use COPYA to copy the disk. 

POKE 47428,24 
RUN COPTA 



I 3 I Make the following sector edits to the 
copy you just made. Don't forget to write the 
modified sector back to disk. 



Trk Set Byte(s) From 



To 



m $05 $00-18 ? 



A9 E7 85 F8 85 
FBA9FC85F9 
85 FC 85 FF A9 
EE 85 FA 85 FD 
85 FE 4C 70 BB 



I 4 I Use Bag of Tricks (Quality Software) 
and re-skew the disk to a 9 descending skew. 
This really speeds up the loading of the game. 

Softkey for... 



Micro Addition/Subtraction 

Hayden Software Company 



■ Requirements 

D 1 blank disk 
D COPYA 
D Sector editor 

Micro Addition/Subtraction is an 
educational program designed for the younger 
children. It teaches elementary addition and 
subtraction skills, but the problems are really 
elementary so they are best suited for younger 
children who are just learning to add and 
subtract. 

The protection scheme used here is the 
standard epilog change. The epilog bytes for 
both address and data fields are AA AA instead 
of the normal DE AA. This is a simple protection 
to overcome. 



I 1 I Boot your DOS 3.3 system disk. 

I 2 I Tell DOS to ignore checksum and 
epilog errors and use COPYA to copy the disk. 
POKE 47426,24 
RUN COPTA 



3 I Make the following sector edits to the 



copy you just made. 
Trk Set Byte(s) From 



To 



$00 $03 $35 
$91 



AA 
AA 



DE 
DE 



You're done. 



A self-booting Thexder 

■ Requirements 

D Backup copy of the original THEXDER disk 
D ngs System Disk v3.1 or later 
D 3'/4" disk drive 
D ProDOS file copy program 
D ProDOS formatted disk with PRODOS 8 and 
BASIC.SYSTEM on it 

The arcade game Thexder is an excellent 
game for the Ilgs owner; top notch graphics, 
sound, and play action are woven togeflier to 
produce an unforgettable gaming experience. 
The one problem, so to speak, of Thexder is 
that it does not boot on its own. You are 
required to first boot into a program selecter, 
such as the Launcher or Finder, and then insert 
your Thexder disk to run the game. A few disk 
swaps later and your game is ready to go. I 



found this lack of the ability to autoboot to be 
annoying to say the least. I thought there must 
be some easier way to go about starting up my 
Thexder game. I found the answer and if you 
follow the steps below, your Thexder disk can 
be fixed up so that it too will autoboot. 

I 1 I Boot up your ProDOS 8 disk with 
BASIC.SYSTEM on it and get into BASIC. 

I 2 I Insert your backup Thexder disk into 
the 3'A" drive. 

PREFIX /THEXDER 



Now rename the Thexder file so that 



it will be used as the ProDOS 16 boot file. 
RENAME THEXDER,THEXDER.STS16 



I 4 I Create a subdirectory to hold all of the 
ProDOS 16 setup files. 

CREATE STSTEM 



I 5 I Go into the SYSTEM subdirectory 
and create two more subdirectories to hold tte 
Tool setop file and the necessaty tools. 

PREFIX /THEXDER/STSTEM 
CREATE STSTEM.SETUP 
CREATE TOOLS 



I 6 I Boot your ProDOS file copying 
program. Copy the files below from the Ilgs 
System Disk (/SYSTEM. DISK) to the Thexder 
disk (/THEXDER). 

PRODOS 

STSTEM/P16 

STSTEM/TOOLS/TOOUnS 

STSTE1I/STSTEM.SETUP/T0OL.SETUP 

After you have finished, your Thexder disk 
should be arranged as follows: 

/THEXDER 
prodos 
thexder. sysl6 

/DATA fmne of these files were altered) 
/SYSTEM 
pl6 

/SYSTEM. SETUP 
tool. setup 
/TOOLS 
tool025 

or, if you have Copy n Plus, a catalog will 

|"gy gal * 

/THEXDER >DATA 

! 

! — >SYSTEM >SYSTEM . SETUP 

j 

!— >TOOLS 

Your Thexder disk can now boot by itself 
and the game will load in automatically. As an 
extra bonus, pressing the 'J' key will toggle 
Joystick mode. No longer do you have to 
always use the numeric keypad. I have found 
that the joystick tends to center to the lower 
right hand comer, so you may have to re-adjust 
your trim pots. 
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Capturing a protected disk's 
RWTS with RWTS Worm 



Looking through the various softkeys from 
issues past, you notice that many of them 
require a copy protected disk's RWTS. This 
RWTS is used to read in the copy protected disk 
and then write out the information just read in 
onto a normally formatted 16 sector disk. This 
is an easy way to deprotect a disk, but obtaining 
flie necessary RWTS is often difficult. I present 
here a way to get that elusive RWTS. The 
program that accomplishes the feat is called 
RWTS Worm and is written in machine 
language. This program works for all protected 
disks that enqiloy a standard DOS 3.3 first stage 
boot, i.e. track $0© sector $0© is the same 
as a normal DOS 3.3 disk, and run off of a 
semi-normal DOS 3.3. With most semi-normal 
DOSs, a BASIC prompt Q) appears after the 
first three tracks have been loaded in. 

What It Does 

When run, RWTS Worm first disconnects 
DOS via a JSR $9EE0, which replaces DOS' 
I/O hooks with the normal BASIC I/O hooks. 
The DOS 3 .3 in memory is moved down so the 
upcoming boot does not overwrite it. Next, the 
disk controller ROM that lives at 
$C60©-$C6FF is moved down into RAM 
memory and modified to the extent that only 
the disk's RWTS is loaded in. Once this has 
been done, the newly read in RAVTS is moved 
to $19OO-$20FF. Finally, the DOS 3.3 that 
was in memory when you loaded the RWTS 
Worm program is moved back to it's normal 
resting spot and it is reactivated via a JMP 
$9DBF (DOS 3.3 warmstart location). 

RWTS Worm will probably not work on 
a disk that has a non standard DOS 3.3 track 
$00, sector $00 or whose BOOTl does not 
load in at $B700, but you can try it anyways. 
A word of caution: the program assumes your 
disk controller card is in slot 6. If it is in any 
other slot, RWTS Worm will not work. 

I 1 I Boot a DOS 3.3 disk and go into the 
monitor. Type in the machine language 
hexdump and save it to disk. 

CALL-lSl 





RWTS WORM 




9500: 


20E0 9EA2 00BD00 9D 


$05E4 


9508: 


9D00 6DE8D0F7EE07 


$1E10 


♦9510; 


95EE0A95AD07 95C9 


$12AF 


9518; 


C0D0E8A2 00BD00C6 


$D75D 


9520: 


9D00 96E8D0F7A9 33 


$BA6B 


9528: 


8DF9 96A9 95 8DFA96 


$8BD6 


9530: 


4C00 96A9 90 8D0E08 


$F51A 


9538. 


A9 4C 8D 4A 08 A9 4C 8D 


$DDB9 



9540:4B08A9 95 8D4C08A2 


$3F59 


9548:60 4C0108 2CE8C0A2 


$D90B 


9550:00BO00B8 9D0019E8 


$A813 


9558;D0F7EE53 95EE56 95 


$5133 


9560:AD53 95C9C0D0E8A2 


$D5C5 


9568: 00BD00 6D9D00 9DE8 


$AF53 


9570:D0F7EE6B95EE6E95 


$3267 


9578:AD6E95C9C0D0E8 4C 


$F97A 


9580: BF9D 


$D5F9 


BSAVE RWTS WOBM,A$9SO«,L$82 




SAMPLE RUN 





I 1 I Boot a DOS 3.3 formatted disk and 
load RWTS WORM. 
BLOAD RWTS W0iai,A$9SM 

I 2 I Take out the DOS 3.3 disk and insert 
your protected disk into slot 6, drive 1 . 

rrn Execute the RWTS worm program. 
CALL 38144 from monitor 9500G 

I 4 I The disk drive will sound like it is 
booting and after a few seconds the BASIC 
prompt Q) will return. The protected disk's 
RWTS has been relocated to $1900-20FF. 

I 5 I All you have to do now is to save the LJ — I 



RWTS to disk. Insert your Super lOB disk. 
BSAVE programnam.SmS, A$1M0, L$8(M 

You're done. You can now use Super lOB 
and the SWAP or NEW SWAP controller to 
deprotect the disk. If you want to use RWTS 
Worm on another disk, you will first have to 
reload it into memory because the code it 
contains is self-modifying. 

Softkeyfor... 



Math Shop 

Scholastic Inc. 



■ Requirements 

D 2 blank sides 

D Whole disk copy program, such as COPYA 
D ProDOS file utilities or ability to get into 
ProDOS BASIC 

Math Shop, by Scholastic, is a math 
oriented educational program. In the Math Shop 
game, you are required to go to one of several 
different stores and "serve" the customers by 
figuring out math problems. After you have 
satisfied all of the customers in one store, you 
must go to another store and continue on 
"serving" them. This becomes quite a task 
when you have lO stores each with 6-7 
customers! If you ignore the customers in a 
store for too long, they will leave thus dq)riving 
you of their "business". 

Copying both sides of the disk with 
COPYA results in no problems. Upon booting 



the front side, the ProDOS title screen comes 
up and then almost immediately the program 
reboots. Since the rebooting occurs right after 
the ProDOS title screen, a good place to look 
for the copy protection code is in the first 
".SYSTEM" file in the directory. 

The first ".SYSTEM" file is called 
MATH.SYSTEM and the file right after it is 
called BOOT.SYSTEM. The MATH.SYSTEM 
file is only one block long, hardly enough to 
do anything except maybe check for an origin^ 
disk?!?!? That's exactly what it does. After 
verifying the presence of the original disk, the 
file BOOT.SYSTEM is then executed. 

Well, it seems apparent what our course 
of action is: alter the disk so that 
MATH.SYSTEM is not executed and instead 
BOOT.SYSTEM is executed. This is easily 
accomplished. After ProDOS is loaded, it looks 
in the volume directory for the first 
".SYSTEM" file and executes it. If we rename 
MATH.SYSTEM to MATH, then it is never 
executed! Since BOOT.SYSTEM is now the 
first ".SYSTEM" file, it is executed which is 
exactly what we want. 

m Copy both sides of the MATH SHOP 
original. 

2~1 Go into BASIC or use a ProDOS disk 



utility program and rename MATH.SYSTEM 
to MATH. 

RENAME IIATH.STSTEH, HATH 



Softkey for... 



ARCmVEmtb 

D.C. Heath & Company 



■ Requirements 

D 2 blank disk sides 

D FID 

D Super lOB vl.5 

ARCfflVEmath is a rather good college 
algebra test generating program. You may 
choose from several areas in math and print up 
to 99 different tests in each area. Examining 
the disk's format with my trusty nibble editor, 
the only protection is that the third byte of the 
data prolog (D5 AA AD) is an AA instead of the 
normal AD. Aside from that, the only 
inconvenience is that you need to use the 
original DOS on the disk because it contains 
routines that the programs need to run. 
m LoMl Super lOB and install the FAST 
controller into it. 

I 2 I Fix the controller so it only copies 
DOS (tracks $00-02). 

lOlS LT » 3 



I 3 t Run Super lOB and answer "YES" 
to the format disk prompt. 



NovwnlMr 



coMPunsT imi 



I 4 I Repeat step #3 for the back side of the 
ARCHIVEmath disk. 

I 5 I Now, from the BASIC prompt (]), 
load FID. 

BLOAOnO 



I 6 I Enter the monitor and alter DOS so 
that it can read ARCHIVEmath's altered 
format. 

CALL -151 

BSFBdtS 90 ignore last byte of data prolog 

B942:18 ignore any chedsum/epilog errors 



I 7 I Run FID. When asked for the 
jilename, enter " = " and answer "NO" to the 
"DO YOU WANT PROMPTING" message: 

8030 



I 8 I You have just copied all of the files 
from the first side of ARCHIVEmath to the first 
blank disk. Now, repeat this step for the other 
sides. 

You're done. No changes need to be made 
to the ARCHIVEmath DOS, so put your 
original away and use your backup. 



Captain Dan 



Softkey for... 



Dondra 

Spectrum Holobyte 



■ Requirements 

D Apple n 

D SuperlOB vl.5 

D Sector editor 

D Three blank disks 

Dondra is a text/adventure game. The game 
was easily copied but upon booting the program 
would die. At this point I was certain that a 
nibble count was being used. 

Scanning the disk for the byte sequence 8C 
C0 ($C08C, it's backwards remember) I found 
some interesting code on track $0<Z>, sector 
$05. It seemed to be looking for a bunch of 
$E7's. It was looking for a signature. It didn't 
matter what I changed the disk would still not 
boot. I then decided that since I could not bypass 
the nibble count, I would give it what it wanted. 



i 



SeeCOMPU'nST^60,page20, "Some notes 
on Epyx" by Stefan Lau for an explanation of 
Prolok signature protection RDEXed 



I turned on my computer, hit iBRESETl , 
entered the monitor, and cleared memory: 

ISRKSETl 
CALL 151 
800:00 



801<800.BFFFH 

I then inserted the Dondra original and 
moved the boot ROM code down to RAM and 
changed it so it would stop after the first stage 
load. 



9600<C600.C6FFM 

96F8:4C59FF 

9600G 

C0E8 

SOIL 



move bootO down 

make it exit to monitor 

run it to load boot I 

turn of drive 

list what we got 

1 then learned that at address $84A the 
program JMPed to $BB(Z>0 for flie second stage 
load. OK let's find out what's there. 



96F8:A9 S9 8D 4B 08 A9 FF 8D 

9700:4C 08 4C 01 08 

96O0G 

C0E8 

BBOOLL 



modify bootl 
to exit to motutor 



list bootl 



Suprise, the nibble count is at the beginning 
of the second stage load. I noticed that after the 
program was finished finding the $E7's it 
loaded more data from the same track ($0A) 
and stored it at $F(Z>-F7. 1 then decided that I 
had to have that data. The data was not loaded 
if the nibble count failed and the program 
needed the data to continue. I had to alter the 
second stage load so it would stop after loading 
the data. 

96F8:A9 00 8D 4B 08 A» 09 8D 
»700:4C 08 4C 01 08 

OSOOUtf 00807CBB4COOBB insert a break 
9600G 
C0E8 
F0.F7 see what we got 

I wrote this information down and then 
made a copy of the original using the controller 
below, which ignores address epilog bytes. 
Suice I was going to give the program the 
information it wanted, it didn't matter what the 
nibble count loaded. I changed it to ignore 
whatever information it found. 



I 1 I Merge the controller into Super lOB 
and copy the original disk. 

I 2 I Use your favorite sector editor to 
make some changes. 

Trk Set Byte(s) Prom To 



$00 $05 $45-46 


D0? 


EAEA 


$4E-4F 


D0? 


EAEA 


$57-58 


D0? 


EAEA 


$66-7B 


? 


A0 07 B9 74 BB 
99 F0 00 88 10 
P7 4C 7C BB PC 
EE EE PC E7 EE 
PCE7 



This is the disassembled form of the 
changes: 

BB66 LDY #$07 
BB68 LDA $BB74,Y 
BB6B STA $00F0,Y 



BB6E DEY 

BB6F BPL BB68 

BB71 JMP $BB7C 

BB74 PC EE EE PC E7 EE PC E7 



I 3 I Copy the remaining sides with Super 
lOB's standard controller or COPYA. 

ControUer 

1000 REM DONDRA CONTROLLER 
1010 TK=0:ST=0:LT = 35:CD=IIIR: POKE 47507,0; 
POKE 47517,0 

1020 T1=TK:G0SUB 490 

1030GOSUB430:GOSUB100:ST=ST+1: IPST<DOS 
THEN 1030 

1040 I FBF THEN 1060 

1050ST = 0:TK = TK+1: I P TK < LT THEN 1030 

1060GOSUB490:TK = T1:ST = 

1070 GOSUB 430 : GOSUB 100 : ST = ST + 1 : I F ST < DOS 
THEN 1070 

1080ST = 0:TK = TK+1: IPBF = 0ANDTK<LTTHEN 
1070 

1090 I PTK<LT THEN 1020 
1100 POKE 47507,174: POKE 47517,164: HOME : 
PRINT "COPY'DONE" : END 

Checksums 



1060 - $0A25 

1070 - $0220 

1080 - $8942 

1090 - $37BB 

1100 - $DE1C 



- $356B 

1010 - $9F9C 

1020 - $08C0 

1030 - $1EC1 

1040 - $5E00 

1050 - $769B 



Softkey for.. 



King's Quest m 

Origin 



■ Requirements 

D Apple n with 128K 
D COPYA 
D Sector editor 
D Five blank disks 

King's Quest m is like its predecessors 
except that it is bigger and we no longer have 
to watch the screens being drawn, but alas, it 
is still extremely slow. The protection is the 
same as King's Quest I & n just in a new place. 

nrn copy all sides with COPYA. 



I 2 I Sector editor the boot disk only. 

Trk Set Byte(s) Prom To 



$02 $08 $12-14 
$0B $0C $FC-FE 



20 00 FF 
20 00 FF 



EAEAEA 
EA EA EA 
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Softkey for.. 



Ultima V 

Origin 



■ Requirements 

D Super lOB vl.5 
D Four blank disks 

Please note: For this softkey to be 
completed properly, you will need 
COMPUTIST #28, #42, and #51 . No I'm just 
kidding. Worried you didn't it. 

The protection scheme for Ultima V is a 
modified PRODOS that changes the sector 
values on the disk, and alters address epilog 
bytes. Each sector beyond track $02 is 
increased by $11. 

For example, sector $06 would be encoded 
as sector $17 ($0(5 + $11). Since there can only 
be 16 ($OF) sectors on a track, any value over 
$0F is unreadable by an unmodified program. 

I wrote the controller below, which ignores 
address epilog bytes and converts the sectors 
to normal values, and copied the disk. Upon 
booting the disk, the protected PRODOS 
operated fine with the normal sectors and epilog 
bytes. The program did not bother to check the 
changed data. 

I 1 I Type in the machine language 
program and save it. 
CALL -151 



1900: A2 00BDB8BF18 6911 

1908:9DB8BFE8E010D0F2 

1910:60A2 00BDB8BF38E9 

1918: 11 9D B8 BF E8 E0 10 D0 

1920: F2 60 

BSAVE DLmiA 5.SC, A$19M, L$022 



$E96C 
$784F 
$353D 
$B7FB 
$E0D7 



I 2 I Merge the controller into Super lOB 
and copy the original disk. 

I 3 I Copy the remaining sides with 
COPYA or Super lOB's standard controller. 

Controller 

1000 REM ULTIMA V CONTROLLER 

1010TK = 0:ST = 0:LT = 35:CD = HR 

1020 POKE 47507,0: POKE 47517,0 

1030 UB = 0:T1=TK:GOSUB 490 

1040 IF UB = 1 THEN 1060 

1050 IF TK = > 3 THEN CALL 6400;UB = 1 

1060 GOSUB 430 : GOSUB 100 : ST = ST + 1 : I F ST < DOS 

THEN 1060 
1070 IF BF THEN 1090 

1080 ST = 0:TK = TK + 1 : I F TK < LT THEN 1040 
1090 UB = 0: GOSUB 490:TK = Tl ;ST = 
1100 I FUB=1 THEN 1120 
1110 CALL 6417 :UB = 1 
1120 6OSUB430: GOSUB 100:ST = ST+1:IFST<DOS 

THEN 1120 



1130ST = 0:TK = TK+1: IFBF = 0ANDTK<LTTHEN 

1100 
1140 I FTK<LT THEN 1030 
1150 POKE 47507,174: POKE 47517,164: HOME : 

PRINT "COPY'DONE" : END 
10010 PRINT : PRINT : PRINT CHR$ (4); "BLOAD' 

ULTIMA'5.SC,A$1900" 

Checksums 

1000 - $356B 1090 - $D00D 

1010 - $3266 1100 - $68D6 

1020 - $5917 1110 - $6483 

1030 - $51D2 1120 - $4681 

1040 - $8CFB 1130 - $2068 

1050 - $DE3C 1140 - $D390 

1060 - $D138 1150 - $33C7 

1070 - $0586 10010 - $129A 

1080 - $752E 



MOST 

WANTED 



ABM Muse 

^nt U.S.A. Sdiolastic 

Mrimm Broderbmd 

Algtblasttr Damkon & Associates 

Algebra I btteHigent Tutor 

AStnMai PBI 

AKhk Datamost 

AffUSuftrTM ? 

AiijuM InteMgaut SiMastic 

Balanct of Pmer Uindscape 

Baiils SriusSofiware 

Bank Street FOer Broderimd 

BaiJi Street Sdwd Fikr Suiihwrst Coimmmcations 

Barron's Computer SAT ? 

Badepoi^ SSI 

Bddtaat Atarisc^ 

BraaBmk The Obsenasorj 

Bargeitime ? 

Q^GooiiHglU 1 

OuemsofCcWsle Origin 

Cei^icaleLilmrjVol.l ? 

Cet^icate Mtktr Up Springboard 

Chuck Jeagfr'sAitaiicedF^Tniiur nearonicArts 

Colossus IV Firdnrd 

Creature Ventm SofismiA Co. 

Cross Counlrj Ralbi SoflsmthCo. 

Daxid's MUid^ Magic ? 

DB Master V4.9 Stoneware 

DeatUard Electronic Arts 

Epiimc S.S1 

F-IS StrSie Eagle Microprose 

Fw/: Tie Masked Womm Didatedi S($me 



Fof'sWordMy Mated Sofimre 

Fortress S.S.I. 

Fun BuKch Umcom 

Gakm Atarisofi 

astatic (Motors S.S.I 

GameSww Advanced Ideas 

Gemstone Hetder SSI 

GradtBusters 1-2-3 Gradebusters 

Gutenburg Jr. Miaomation LTD 

Handicapimg System Sports Judge 

Impossible Mission Epyx 

Jigsatu Microjim 

Joust Atarisoji 

KM mail Dead Accolade 

Legacy of die Andtttts ElectromcAns 

IMt Computer Peoples House on a Disk Activision 

LoBipopDn^ Society for Visud Ed 

Cursor Control Adventures 

Plotting ft Programming Adventures 

Letter ft Number Key Adventures 

Function Key Adventures 

MapcSpeBs The Learning Company 

Man Golf Thunder Mountain 

Micro League Baseball Micro-league Sporu 

Mr. Do Datasoft 

Mr. Pixel's Cartoon St Mindscape 

Mi. Pac-Man Ataiisofl 

Never Ending Story Ikaisoji 

Odin Odesta 

OnBalaiue Broderbund 

Peeping Tom Microlab 

Pensate Penguin 

Personid Finance Manager (PFMj Apple Computer 

Prime Phller Primesoft Corp. 

Principals AssisM library Mindset^ 

Print Master Unision World 

Pro-Fo(Ml Sports Judge 

Publisher Springboard 

PuakskPosUrs MECC 

(^Casde Didatech Sojimre 

RuddDud SofismithCo. 

ScraibU Electronic Arts 

S.E.V.I.S. S.S.I. 

Siwjgje Broderbund 

Space Eggs Sinus 

Space Journey Mindscape 

Spare Change Broderbund 

SteUar? Penguin Software 

Stdlarl Software Entertainment 

Success wiA Typing vl.2 Scholastic Software 

Si^r Factory Sunburst 

TomiAawk ? 

ThmkTaik Living Mo 

Toy Shop Broderbund 

Universe Omitrend 

Universe H Omnitrend 

Yiailend Miaolab 

Wargjle Hoyden 

Wheel of Fortime ? 

Wherein^ USA is Carmen San Diego Brodeibund 

Wiere in the WoiU is Carmen San Diego Broderbund 
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\Mii Features: 'Reading from Protected 
Disl(s 'EDASM Transfer Utility 'Amper QuickDraw II Routines 
•Skw Speeds for Arcade Games 'A Patch for Copy II Plus 'Ttie 
Product Monitor 'Low Cost Alternate liinguages •Another 
method for Copy-Protecting DOS 3.3 'Change Appleworks 
Cursor from a lilinking underline to a lilinking apple in one quick 
patch tSoflkeys: 'Ace Programmer 'Aesop's Fables (GS) 
•Apple GEOS v2.0 'Artie Antics 'Creating the Constitution 
•Crossword Magic 4.0 •Death Sword ♦Dome Bookkeeping 
'Essential Data Duplicator III (EDD 3) 'Garfield Deluxe Edition 
•Gauntlet llgs •J & S Gradetxwk 'Kings Quest llgs 'Kings Quest 
I (6S) 'Lazer Maze 'Leisure Suit Larry 'Magical Myths 
•Mastertype v2.1 •Mavis Beacon Teaches Typing •Mind 
Prolwr/Mind over Minors •NATO Commander v1.2 •Paperboy 
•Pegasus 'Pinball Construction Set 'Pod 1.5 •RAD Warrior 
•Railroad Works •Road Rally USA •Robomath •Science Tool 
Kit •Search and Rescue •Showoff •Social Studies Vol 1 •Social 
Studies Vol 2 •Solo Flight 'Space Quest 'Springboard Publisher 
'Spy vs Spy III 'Star Fleet I v2.1 'Tales of Fantasy: The Dark 
Tower, Frog & The Fables •Tapper •Troll Courseware: Maps 
& Gk)bes, Latitude & Longitude •Type! •Ultima V •Wagons West 
•Zorro « MAPTs: 'Kid Niki Radical Ninja •Lode Runner 
•Space Quest He 'Thexder « §P/ayi/y Tips: •2400 A.D. 
'Captain Goodnight 'Space Quest He ^MNotes: 'Defending 
the Crown with "Visit Monitor" 'Fotmatting extra tracks 
•Merging controllers with Super lOB 'More on Tower of 
Myraglen 'Some notes on Electronic Arts 'Some notes on Epyx 
'Tips for cracking llgs W disks /Ml Softkeys: 'Clipper 
'DoubleDOS vl.O 'LoadCalc v4.13 'Mind Prober 



Wli* Features: 'Boot He Utilities on any 
compatible 'Help with Ultima V 'Convert Printmaster graphics 
Into Print Shop graphkis 'The Invincible Bard (III) 'The 
Deprotection Game 'Patching ProDOS 1.1.1 'The Product 
Monitor 'AppJeWorics and the ImageWriter II ii Softkeys: 
•APBA Major League Players Baseball 'Better Working: 
Spreadsheet 'Better Working: Word Processor 'Beyond Pinball 
•BoulderDash Construction Kit 'Calendar 'Calendar Crafter 
•California Games •Champkxiship Baseball •Clip Art CoHectkm 
vol 1 'Cours Et Gagne v1.0 •Dazzle Draw •Everbody's Planner 
•GATO v1.3 •GoldFinger •Jumpman 'King's Quest 
'Management Edge 'Movie Monster Game 'MultiScribe v3.0 
'Negotiation Edge 'Nightmare Gallery 'Patchworira 'Picture 
Phonics 'Printographer 'Reader's Treasure Chest 'Real Math 
•Sea Strike •Shifty Sam •Simulatkxi Construction Kit •Snoopy's 
Reading Machine 'Snoopy's Skywriter Scrambler 'Snoopy to 
the Rescue 'Songwriter 'Spell It! 'Stickybear Reading 
Comprehension 'Super BoukJerDash tAPTs: 'Bard's Tale 
III •Super BoulderDash •Ultima V « Playirtg Tips: •Alternate 
Reality •Auto Duel •Ultima V •Where in the Worid is Carmen 
Sandiego /MSoftkey: •Chartmaster v6.04 •Clout vl.O 
•Copywrit •Graphwriter •SIgnmaster v5.04 



1988 « Fe^vres: •Mixing ProOOS with Thexder 
•Infocom Decoder Revisited •Cracking on the He •Might & Magk; 
Revisited 'Might & Magk; Character Editor 'An indepth guide 
to Ultima IV •Computing for 1-3 year okis •The Product Monitor 
tSofffisys: •A.I. •BoukJerDash •BoulderDash Constructnn 
Set •DeathSword 'Design Your Own Home: Architecture 
•Design Your Own Home: Interior 'Design Your Own Home: 
Landscape 'Facemaker •Gauntlet •Kings Quest II 'Mastery 
Arithmetic 'Microzine #26 'Muppet Slate vl.O 'PFS: Graph 
•Polywriter 1.2 'Rad Wanior 'Rings of Zilfin 'Seaspeller 'Smart 
Eyes 'Spell It! 'Wings of Fury *APTs: •Castle Wolfenstein 
•'Mari}le Madness llgs 'Might & Magk; 'Ultima IV 'Ultima V 
*/%W Ti/x: 'Coveted Miffor 'Deathlord 'Might & Magic 
'Oo-Topos 'Ultima IV * fi/Otes: 'A better way to print Starter 



Kit DOC'S 'Curing Fatal System Error 1091 1 •Realtime Situatran 
Control using CDAs •Chuck Yeager's Advanced Right Trainer 
•IBMA(3te5 'Help Wanted! 



I9!m Features: •Electronic Art's Protectwn 
Language 'How to find hklden code with EOR DiskScan •Here's 
another look at •Lower Case & Infocom Games •Monsters of 
Might & Magk; 'A Character Editor for Rings of Zilfin 'A Single 
Data Disk for all your Print Shop Graphics 'The Product Monitor 
a Softkeys: 'American Challenge 'Arctic Fox 'Bard's Tale 
I! 'BoulderDash Construction Set 'California Games 
•Championship Wrestling •Chief of Detectives/Drawing 
Conclusions •Deep Space 'Dome Simplified Bookkeeping 
System •Dr. Ruth's Computer Game of Good Sex 'Earth Orbit 
Stations 'Factory 'Galaxy Search/Predk^ing Outcomes 'Game 
Maker 'Hacker I! •Hardball llgs 'Ikari Warriors 'Labyrinth 
'Marble Madness 'Master Diagnostics He 'Math Blaster 
'Mickey's Space Adventure 'Mcr&Computer Learning Games 
'Microzine #14 'Microzine #24 'Milllken Math Series 'Mind 
Prober 'M-ss-ngL-nks 'Morning Star SpeHing 'Mountain 
Climbing/Cause and Effect 'Movie Monster Game •Pond •Race 
Track/Reading for Detail •Reading Comprehension Main Idea 
& Details ••Rings of Zilfin •Roadwar 2000 •School 
Days/Inference 'Ski Crazed •Softswitch •Sub Missmn •Time 
Capsule/Reading Skills 'Tuesday Morning Quarterback 
'Typewriter 'Where in Europe is Carmen Sandiego 
'Wortgefecht 'XevBus tAPTs: 'Deep Space 'H.E.R.O. 
'Moebius 'Rings of Zilfin •Roadwar 2000 * Playing Tips: 
• Arcticfox •Castle Wolfenstein 'Conan •Donkey Kong •Ultima 
IV IBM Softkeys: Symphony vl.OO •TK! 



\^ ft Features: 'Apple llgs Secret Weapon 
•5 second fastboot into Locksmith 6.0 Fastcopy 'The Product 
Monitor 'Taking the grind out of Championship Wrestling 
'Making some improvements to The Nibbler < SM^: •2400 
AD •40' Graphics Studk) •Accolade Comics •Aesop's Fables 
•American People 'Animal Hotel •Applewriter He •Arcade 
Album #1 • ArctK Antks •Ballblazer 'Bard's Tale !l: The Destiny 
Knight 'Bard's Tale llgs 'Cat'n Mouse 'Champwnship Wrestling 
'Chariie Brown's 1,2,3's 'Cobra Cavern 'Cokjr Me 'Create With 
Garfiekl 'Davkl WinfiekJ's Batter Up! 'Destroyer 'Disk Optimizer 
II 'Oragonworid •Electronk; Arts Software 'En Vacances 'En 
Ville 'Fantavision gs 'Fight Night •ForbWden Castle 'G.l. Joe 
•Garfield Double Dares •General Manager •Goonies 
•GraphicWriter 2.0 •Gutenberg, Sr. •Hacker II •Hardball 
•Hardball gs •Infiltrator 'James Bond 007: A View to a Kill 
•Keyboard Kadet 'Kids on Keys •Lazer Maze 'Le 
Demenagement •Le Francais par Otdlnateur: 'Leisure SuH 
Larry in the Land of the Lounge Lizards 'Les Sports 'Lion's 
Wori(shop 'Microzine #21 'Mterozine #22 •Milliken Word 
Processor 'Millionair II 'Multiscribe v2.0 'Multiscribe v3.0 
'Multiscribe llgs v3.01c 'Paris En Metro 'Pitfall II 'Racter 
•Railroad Wori(S •Rambo: First Bkxxi Part II 'Realm of 
Impossibility 'Same or Different 'Sea Dragon 'Sea Strike 
'Shanghai 'ShowOff 'Shuttertjug •Silent Sewks llgs •Snoopy 
to the Rescue •Snoopy's Reading Machine •Snoopy's Skywriter 
Scrambler •Space Quest I 'Space Station 'Spy Hunter 'Spy's 
Adventures in Europe 'Spy's Adventures in North America 
'Stephen King: The Mist 'Story Maker 'Street Sports Basketbal 
'Sub Battle Simulator 'Super Sunday Football 'Talking Text 
Writer 'Type! 'Un Repas Francais •Voodoo Island •Where in 
Europe is Carmen Sandiego •Winnie the Pooh •Winter Games 
•Winter Games gs 'Wordzzzearch 'Worid Games gs liAPTs: 
'2400 AD 'Kung-Fu Master 'Lady Tut 'Ultima V it Playing 
TI/k: '2400 AD 'Deathlord 'Space Quest 'Ultima IV 'Ultima 
V 'Wrath of Denethenor BM Softkeys 'Execu-Viston 'MS Word 
'PC-Draw 'Zork I & II ttMes: 'Not too happy with Copy 
II Plus v8.1 'Data disks cause Appleworks crash 



May im* Features: 'A Utility to Save the 
Lower 8 Pages of Memory 'Bard's Tale Effects Locator •How 
to Capture Phantasie Screen Maps •Alternate Reality Character 
Editor •Updating the ProDOS Block Editor •Loading Rashcalc 
onto your RAMcard 'A Copy-protection Scheme for ProDOS 
•The Product Monitor •Autoduel Car Editor ^Sokeys: 
•Alphabet Sequencing 'Animal Alphabets and Other Things 
'Arctic Antics 'The Boars' Store 'The Boars Tell Time 'Career 
Focus 'Castle Wolfenstein •Chariie Brown's 123's •Chariie 
Brown's ABC's •City Country Opposites •Coveted Min'or 
•Create With Garfield •Crypt of Medea •Customized Alphabet 
Drill •Customized Flash Spelling 'Dig Dug 'Digital Paintbrush 
System 'Estimatwn 'Fay: Word Hunter 'Rx It •Focusing on 
Language Arts 'Fundamental Capitalization •Fundamental 
Punctuation Practice 'Fundamental Spelling Words in Context 
'The Hobbit 'Homonyms in Context 'Individualized Study 
Master 'Inside Outside Shapes 'Inside Outside Opposites 
'Leisure Suit Larry in the Land of the Lounge Lizards 'Master 
Diagnostcs II & 11+ 'Mastertype v2.1 •Mathematks Series •Mr. 
and Mrs. Potato Head •Paper Models - The Christmas Kit 
•Peanuts Math Matcher 'Peanuts Maze Marathon •Peanuts 
Picture Puzzlers •Perry Mason: The Case of the Mandarin 
Murder tRailroad Wori(s •Random House Library 'Mam^ement 
Programs 'Rooky's Boots v.4 'Sensible Speller 'Snoopy's 
Reading Machine 'Snoopy's Skywriter Scrambler 'Snoopy to 
the Rescue 'Snoopy Writer 'Spelling Demons 'Stock Market 
Simulation 'Story Builder 'Story Starter 'Studk) II 'Test Maker 
•Think Quick vl.O •Tournament Bridge •Tutorial 
Comprehension •Typing is a Ball, Chariie Brown 'Under Fire 
'Word Blaster 'Word Count 'Word Mount 'Your Personal Net 
Worth 4APTs: 'Under Rre mu Feature: 'Right Simulator 
RGB Modifications 



April 1988 *fta/i//ea- 'Picture Loader 'How 
To Make DEMUFRN PLUS 'Convert Print Shop graphics into 
Print Master graphks 'tower case letters For Your Apple II Plus 
'The Product Monitor 'Apple He Paddle Rx 'Softkey for Daisy 
Professional 'Most-Protected' Award 'DOS EOR Maker 
^Softkeys: A2-PB1 Pinball 'Animate 'Bank Street Music 
Writer 'Boulderdash Construction KH •California Games 
•Countdown to Shutdown •Coveted Mirror •Create with Garfieto 
'Daisy Professional 'Destroyer 'Donkey Kong 'Expeditran 
Amazon 'General Chemistry Disk #8 'Grajihks Studk) 'Green 
Gtobs & Graphk; Equatnns 'Kalamazoo Teacher's Record Book 
2.0 'Kids on Keys 'Marble Madness 'Math Blaster 'Maxwell 
Manor 'Peanut's Maze Marathon 'Petr^Calc 'Police Artist 
'Practical Grammar 'Rendezvous 'Ring Quest 'Roadwar 
Europa •Roadwar 2000 'Rocky Horror Show 'Sesame Street 
Electrk; Cotoring Book Series 'Sesame Street Letters for You 
'Sesame Street Numbers 'Seven Cities of GoW 'Snoopy's 
Reading Machine •Spy's Adventures In Europe •Spy's Demise 
•Super Sunday Football 'Talisman 'Tellstar II 'Top Draw 
vl.OIA 'The American Challenge 'The Dam Busters 'The 
Science Professor 'Tubeway 'Vocabulary Adventure I 'Winter 
Games 'Wizards' Crown 'Zero-Gravity Pinball tiAPTs: 
•Expeditton Amazon 'Might and Magk; ^Playing Tips: 
•Beauracracy •King's Quest II •Lurking Horror 'Maniac 
Mansion 'Statlonfall VkUFeature: 'Introductton to IBM Disk 
Format, Access, and Copy-protection 'Putting Sargon HI on 
harddisk fflM5l9/iite>s.- 'Prokey 3.0 'R:base 400 'Time 
Manager 



Mareh 1988 « Features: 'Modify Super 106 to 
read/write every other track 'APT for Rings Of Zilfin: Turn 
yourself into a lean, mean fighting Machine •More Softkeys for 
M.E.C.C. software ( 1987 ) •How To Use The Electrons Art's 
RWTS •APT for Realms Of Daritness: Realm's Wrecker! 
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•Putting Super Boulder Dash onto a hard disk tSoftkeys: 
•2400 A.D. •Age Of Adventure 'Apple's Core II •Arrade Boot 
Camp 'Arclic Fox •Aziec •Ballblazer •Bard's Tale llgs •Blue 
Powder Gray Smoke •California Games •Championship 
Wrestling •Colonial Conquest •Comprehenskin Skills 1,11 
•Conquering Whole Numbers •Coordinate Math •Countdown 
To Shutdown •Dataquest: The World Community •Destroyer 
•Dream House •Dream Zone 'Earth Orbit Station •Equation 
Math •Forecast: Your At-Home Weather Station •Fraction 
Concepts Inc •Fractwn Munchers •Fraction Practice Unlimited 
•GBA Champkxiship Basketball •Genesis "GFL Football •Ghost 
Rider •Goonies •Grade Manager v2.3 •Great American Cross- 
country Road Race 'Hardball llgs •Ikari Warrior 'Jenny's 
Journeys •Kid Niki Radical Ninja •Kung-Fu Master 'Learning 
To Tell Time 'Leisure Suit Larry 'Let's Learn About Money 
•Let's Learn About The Library •Letters For You •Lords Of 
Conquest 'Magic Spells 'Math Blaster •Money Works •Maps 
& Gk)bes: Latitude & Longitude •Marble Madness •MIcrozlne 
18,19,20,21,22,23 'Mist 'Morning Star Math 'Movie Monster 
Game 'Multiplication Puzzles •Multlscribe v3.0c •Murder On 
The Mississippi •Music Made Easy •Mystery Sentences 
•Number Munchers •Numbers Count •Odell Lake •Operation 
Frog •Opposites Attract •Oregon Trail v1.4 •Phonics Prime 
Time: Blends & Digraphs •Phonics Prime Time: Vowels I, II 
'Puzzles & Posters 'Quotient Quest 'Reader Rabbit •Reading 
Style Inventory •Realm Of Impossibility •Sesame Street 'Crayon' 
series •Shanghai •Sons Of Liberty 'Space Quest v2.2 'Story 
Book: Pixelworks 'Story Tree •Subtractkin Puzzles •Super Huey 
•Super Wordfind •Tass Times In Tonetown 'Those Amazing 
Reading Machines III, IV 'Timothy Leary's Mind Mirror 'To 
Preserve, Protect and Defend •Tower Of Myragten •Troll's 
'McroCoarseware' series •Webster: The Word Game •Word 
Munchers •Words At Woric Compound It •Words At Work: Suffix 
Sense •Worid Games •Worid's Greatest Baseball Game •WorM 
Karate Championship •Writer Rabbit •Zoyon Patrol tAPTs: 
•Buck Rogers •Ikari Warrior •Kung-Fu Master •Leisure Suit 
Larry llgs •Marble Madness •Realm Of Darkness •Rings Of 
Zilfiri •^ace Quest llgs 'Super BoukJer Dash « Playing Tips: 
'24®® A.D. 'Donkey Kong •Infiltrator •Space Quest llgs •Spy 
Hunter •Swashbuckler •Thexder •Ultima II • \mSoftkeys: 
'EasyWriter 1.0, II 'Zork III 



February 1988 * Features: 'The Product 
Monitor •UnprotectingThe Unprotectable: Macintosh Soflkeys! 
•A.P J. Cornucopia •APT:Altemate Reality-Dungeon: Create A 
Super-human •Softkey for SSI's RDOS disks: 1 .PtoDOS RDOS, 
2.RD0S Transfer Utility •Making Cracked II Plus Disks Work 
On The lie tSoftkeys: •Apple Gradebook v2.6 •Award 
Maker Plus •Black Cauklron •Black Magic •California Games 
•Car Builder •Color Print Shop •Computer Ambush •Concepts 
In Science •Disney's Comic Strip Maker •Elite •Empire I, II 
•European Nations & Locations •Fooblitsky 'Grid Designer 
•H.E.R.O. •Ikari Warriors •Infiltrator II •Le Francais par 
Ordinateur •Utile Computer People's House on a Disk * Main 
Street Filer •Master Diagnostics lie •MegaFiler iMegaMerge 
•Mkirozine 23 'Might & Mage • Millnnaire 'Mindplay software 
•Musk Construction Set •Nibbler •Operalkw Market Garden 
•Phantasie *Planetfall •PrintMaster Plus •Print Shop 
•Questron •Regatta •Ring Quest •Ringside Seat •Rings Of 
Zilfin 'Shanghai 'Silent Sen/k;e •Snooper Troops •Spy's 
Adventure in N. Amerca •Super Print 'Tass Times In Tonetown 
•Think Quk;k *Transylvania •Ultima I re-release •Where in the 
USA is Cannen Sandiego •Worid Games *1M( * Macintosh 
scMe^ 1kA.P.T.s: Alternate Reality: The Dungeon •Arctic 
Fox 'Bard's Tale II •Beyond Zork •Black Magic •Cavern 
Creatures •Drol •Goonies Mkari Warriors •Zorro ii Playing 
Ti^s: •Beyond Castle Wolfenstein •Champnnship Lode Runner 
'Conan 'King's Queen II •Lode Runner •Lurking Horror 
'Station Fall 'Ultima IV 'Zork \mSoftkeys: 'Lotus 1-2-3 



•Flight Simulator •PFS Report IBM APTs: •Bard's Tale 

51 January 1988 f$<3/u/'<9£^TheCrypl-arithmetic 
Helper •Using EDO IV to Modify Tracks And Sectors •Bard's 
Tale APT: Dungeon Mapper Revisited •RAMfactor mod for Laser 
128 •Ultima IV APT edit-tables 'The Product Monitor •Get Better 
Sound by using the cassette jacks 'Making A Fast Boot Disk 
•Might & Magic APT edit-tables Softi(eys: ^2400 AD •Aliens 
•Alphabet Zoo •Amnesia •Bag Of Tricks •Bard's Tale I •Bard's 
Tale II •Battle Cruiser •Beach-head II •Bekw The Root •Black 
Mage 'Body Awareness 'Bridge 40 'Carriers At War 'Catalyst 
3.® 'Centipede 'Championship Boxing •Championship 
Wrestling •Chessmaster 2000 'Combining The Elements 
•Commando 'Creative Contraptions 'Einstein Compiler 'Fat 
City 'Fight Night 'Flight Simulator v2.(D 'Fun with Direction 
'GBA 2-On-2 Championship Basketball 'GraphcWriter v1 .1 RA 
•Growing Up Small 'House^)n-a■disk 'Intrigue •Jet 'Jungle 
Hunt 'Kindercomp •Knowing Numbers •Kung-fu Master 'Law 
Of The West •Learning Well series •Letters And Words •Little 
Computer People •Make Your Own Murder Party •Manic 
Mansion •Master Diagnostics •Movie Maker •Music 
Construction Set •Pinball Constructkw Set 'Pitstop •Print Shop 
Graphics Library Holiday 'Print Shop llgs 'Rendezvous 
•Shapes And Patterns 'Silent Service 'Sorcerer 'Spy vs Spy 
I & II 'Stargale •Stellar 7 •Stekybear ABCs •Stekybear Drawing 
•Stickybear Numbers •Stickybear Printer 'Stickybear Printer 
Library I & II 'Stekybear Townbuilder 'Super Boulderdash 
'Temple Of Apshai Trilogy 'Tomahawk 'Thexder 'Walt 
Disney's Card And Party Shop 'Walt Disney's Cartoon Maker 
'Wings Of Fury 'Word Maze 'World's Greatest Baseball Game 
•Zori( IIM.^.7:s; Bard's Tale •Lode Runner •Might & Magic 
•Ultima IV •W. Disney's Card And Party Shop •Wizardry III 
•Wizardry IV Playing Tips: •Autoduel •King's Quest •Mane 
Mansion 'Summer Games 'Tass Times In Tonetown 'Thexder 
•Where In the Workj is Carmen Sandiego? 



December 1987 Features: 'Super Boulderdash 
APT-writer 'Soltkeys to Activlsion/ MECC/ and PFS ProDOS/ 
software 'Double F-8 ROM space w/o mothertward surgery 
'Ace-Apple bimodal Switch 'Using Sider hard drives 3%", 
mtf. drives, & B'A " drives in DOS 3.3 Softkeys: 'Aliens 'Alter 
Ego 'Alternate Reality 'Amazing Reading Machines 'Amazon 
•American Challenge •Arcade Album #1 •Arithmetic Critters 
•Award Maker •Baseball Database •Bard's Tale II: Destiny 
Knight •BC's Quest for Tires 'Bop & Wrestle •Champ. Boxing 
•Chan^. Wrestling 'CkKk Woris •Commando •Computer Prep 
lor SAT •Conffict In Vietnam 'Counting Critters 'Crisis Mountain 
•DataquesI 50 States 'Deluxe Paint II 'Dino Eggs 'Disney Card 
& Party Shop 'Disney Comic Strip Maker 'Draw Plus •Eidolon 
•Electric Crayon ABCs 'Expeditron Amazon 'Pacemaker •Rrst 
Letter Fun •Fish Scales •Fun From A-Z •Game Maker •GBA 
Champ. Basketball •GFL Champ. Football •Graphicwriler 
1.0Ryi.1R •Great Road Race •Hacker II •Hardball 'Infiltrator 
II 'Instant Music 'James Bond 007: A View To A Kill 'Jenny's 
Journeys 'Kung Fu Master 'Little People 'List Handler 'Manic 
Mansbn 'Mastery Arithmetic Games 'Market Place 'Master of 
Lamp 'Math Rabbit 'MIcrozlne #17 •Might and Magic •Missnn 
In Solar System •Moebius 'Musk; Construction Set •Muse 
Studk) 'Number Munchers 'Paint With Words •Paintworis Rus 
•Path Tactes •pfs:nie •pfs:Graph •pls:Plan •pfs:Report 
•pfs:Write 'Phonics Prime Time 'Portal 'Principal's Assistant 
•Print Shop ProDOS 8 v1.4 •Print Shop Holiday Editkw 
•Quickflash! •Reader Rabbit 'Realm of Impossibility •Robot 
Odyssey I v.2.0 'Rocky Horror Show 'Rooky's Boots v4.0 
•Saracen •Shanghai 'Silent Service 'Skylab 'Sound Tracks 
'Speedy Math 'Spindizzy 'Street Sports Baseball 'Sub-Missen 
'Super BouWerdash 'Tass Times in Tonetown 'Thexder 'Top 
Fuel Eliminator 'Word Handler 'Word Munchers •Words at 
Work 'Worid Karate Champ. 'Writer's Choice: Elite 'Zardax 
V5.2.1 



November 1987 Features: 'Eliminate some 
ProDOS erroneous error messages 'Date/time without a clock 
card •Sector surgery: recover lost files •Generating Applesoft 
programs 'on-the-fly' 'Product Monitor reviews »PLUS: How 
to convert List Handler files into standard text files 'How to make 
GRAPHIC.GRABBERv3 run on the llgs •Laser 128 'absolute' 
RESET /%/w^ Tips: •Bard's Tale II •Conan 'Donkey Kong 
•Hacker I •Hard Hat Mack 'Orbitron 'Print Shop Companron 
'Spellbreaker 'Spy Hunter 'Ultima 4/4./'. Is: Infiltrator 'Lode 
Runner •Montezuma's Revenge •Swordthrust series 5i3ftte>s.- 
'Addition Logician 'Animate 'Arcade Boot Camp 'Arctic Fox 
'Bard's Tale II 'Cat'n Mouse 'Counting Critters 'Dam Busters 
t 'Destroyer •Draw Plus v1 .0 •Dr. Ruth's Comp. Game Of Good 
Sex 'Echo 1.0 'E.D.D. 4 'Gamemaker 'Hard Ball 'Infiltrator 
'List Handler f 'Locksmith 6.0 Fastcopy t 'Magic Slate 'Math 
Critters 'Millionaire 'Mind Mirror 'One On One 'Paintworits 
Plus vl.O 'Paintworks Plus vl.1 'PHM Pegasus 'Portal 
'Quotient Quest 'Reader Rabbit 'Saunder's Chemistry CAI 
•Science Toolkit •Shanghai 'Strip Poker t 'Super Bunny 
'Super Sunday 'Swordthrust series t 'Tenn Paper Writer •Thief 
•Top Fuel Eliminator •Typing! t •Up-n-Down •Willy Byte 
•Writer's Choee Elite v1 .0 'Writing A Character Sketch •Writing 
A Narative 



October 1987 Features: •Dungeon Editor & 
Encounter Editor for Ultima III 'APT for Shadowkeep •Softkey 
for Shadowkeep •SofU(ey for Apple Business Graphes ScMceys: 
•816 Paint GS •Amnesia •Arctic Fox •Award Maker Plus 
•Bard's Tale II •Betterwori<ing Word Processor •Beyond Castle 
Wolfenstein 'Black Magic 'Bookends Extended 'Bop & Wrestle 
•Chess 7.0 •Chessmaster 2000 •Deluxe Paint GS •Destroyer 
•Hacker II •Hacker II GS •Hardball •Infiltrator 'Instant Music 
GS 'J-Bird 'Mabel's Mansion 'Marble Madness 'Mean 18 GS 
Golf 'Megabots 'Might & Mage 'Miner 2049er II 'Mouse Word 
'Muse Construction Set GS 'Music Studio GS 'New Oregon 
Trail 'Paintworks Plus 1 .0 GS 'Paintwori(s Plus 1 ,0 GS 'Paul 
Whitehead Teaches Chess 'PHM Pegasus 'Poetry Express 
'Print Shop color version 'Rambo: First BkxxJ part II 'Rocky 
Horror Show 'Sargon III* 'Shanghai GS 'Spindizzy 'TelePorter 
'Temple Of Afshai trilogy 'Top Draw GS 'Transylvania 'Ultima 
I •Worid's Greatest Baseball Game 



September 1987 fesft/zes.' •Infocom-lext Reader 
Enhancement •CokK Ultimapper mod to Ultimapper IV •Towne 
Mapper utility for Ultima IV •Dungeon Mapper utility for Bard's 
Tale Hardware Comer: Interrupting Your Apple •Softkey for 
Chariie Brown's 1,2,3s Soltkeys: •Guitar Wizard 'Gemstone 
Wanior 'Notable Phantom 'Mero Wine Compankm 'Stickybear 
Printer 'Note Card Maker 'Starcross 'Wishbringer 'Dinosaur 
Dig 'Dam Busters 'Pirate Adventure 'Infiltrator 'MECC 
software 'Banner Catch 'Turtle Tracks 'PFS File 'Microzine 
#12, #13, #14 'Marble Madness 'Writer Rabbit 'Arcticfox 'Age 
Of Adventure 'Might And Magic 'Space Statkm 'Alternate 
Reality 'Mindshadow 'Gemstone Warrior •Strip Poker 
•Lucifer's Realm •Manuscript Manager •Bank Street Writer III 
•Kids On Keys •The Missing Ring •Graphe Solutnn 'Empire 
I, II 'Champ. Golf 



August 1987 fSsti^S'.' 'Advanced Merosystems 
Technotogy programs 'Word Attack 'Star Blazer 'Science 
Toolkit •The Color Enhanced Print Shop •VMeo Vegas 'The 
Handlers 'K.C. Deals On Wheels 'Law Of The West 'Break 
The Bank Blackjack 'Foundation Course In Spanish 'OGRE 
•Puzzles And Posters Feature •The Shift Key/Lower Case 
Opten For II + 'Amazing Computer Facts 'Shape Magic utility 
Review. Multlscribe 



July 1987 Softkey: 'Mouse Calc 'Sands of 
Egypt 'Number Fann •Agent U.S.A. •Wavy Navy •Kindercomp 
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COMPCTIST back issues 



To order, Use the back issue order form on page 42 



•Flight Simulator Update »Raid over Moscow •Crime Stopper 
•Key Perfect 5. •The Final Conflict 'Miss Mouse •Snoggle 
Features •Write Protecting the Microsoft RAM Card 'Keys to 
Success on the Franklin Ace •Modified F8 ROMs on the Apple 
/// Core •Owner's Review of Copy Master II 



June 1987 Softkeys: 'Arcade Boot Camp 
•Goonies •Zorro •Coveted Mirror 'Crimson Crown 
•Compubridge •Fleet System 3 •Microwave 'Escape •Catalyst 
3.0 •Number Farm •Alphabet Circus 'Joe Theisman's Pro 
Football •Black Cauldron •Intern. Gran ?m Features 'Making 
DOSIess Utilities 'Pixit Printer Drivers /?wi?r Z-RAM Memory 
Expansion Board 'Reading the Joystick 



May 1987 Mkeys: •Graphics Expander 
•Information Master •Certificate Maker •Elite •Catalyst 2.0 and 
3.0 •Murder On The Mississippi •Temple Of Apshai Trilogy 
•Troll Associates programs •Spell It •Regatta •Cdex Training 
programs •Think Fast Features 'How to Write-Protect your Slot 
Zero 'Capturing Locksmith 6.0 Fast Copy 'Revisiting DOS to 
ProOOS and Back Core 'Computer Eyes / 2: a Review APTs 
'Sword of Kadash & Rescue Raiders 'Ultimaker IV 



April 1987 Soteys.-'LightSimulator'Beach- 
Head 'Monty Plays Scrabble 'Racter 'Winnie the Pooh 
•Infocom Stuff, Kabul Spy, Prisoner II 'Wizardry 1 & 2 'Lucifer's 
Realm 'The PFS Series 'Dollars and Sense 'Strip Poker 
'Coveted Mirror 'Wizard's Crown 'The Swordthrust Series 
'Axis Assassin 'Manuscript Manager 'The Crown of Arthain 
'Address Book 'Decimals 3.0 'Dragonfire Features 'Auto Duel 
Editor •Wizard's Crown Editor •Questron Mapper Core: •The 
Games of 1986 in f\e\i'm Adventure Tips •Ultima IV 

4 1 March 1987 Softkeys: 'The Periodic Table 
•Gemstone Warrior 'Inferno 'Frogger 'Story Maker 'Adventure 
Writer 'Mummy's Curse 'Zaxxon 'The Quest •Pitfall II 
•H.E.R.O. Features »k Two-Drive Patch for Winter Games 
•Customizing the Speed of a Duodisk 'Roll the Presses Part 
Two: Printshop Printer Drivers •The Games of 1986 

^e.%3 February 1987 5l5!fSfe>s,- 'Adventure Writer 'E-Z 
Learner 'Mychess II 'Raster Blaster 'Cranston Manor 
'Ghostbusters 'Designer's Pencil 'The American Challenge 
'Encyclopedia Britannica Programs 'Crime Wave Features 
•Taking the Wiz out of Wizardry 'Adding a Printer Card Driver 
to Newsroom Core: Games of 1986 



January 1987 &*i?>s.-'MIDI/8+ 'Homeword 
v2.1 'Borrowed Time 'Amazon 'Speed Reader )[ 'Discovery! 
'M-ss-ng L-nks series 'Donald Ducks's Playground 'Mastering 
the SAT 'Copy ]| Plus 4.4C 'Master of the Lamps 'One on One 
'Bridge Baron 'A.E. 'Great American Cross-Country Road Race 
•Computer Preparation for the SAT •Castle Wolfenstein 
•Luscher Profile 'Skyfox •Silent Service •Echo Plus 
•Swashbuckler 'Randamn Features •Electronic Disk Drive 
Swapper 'Abusing the Epilogues 'Print Shop Companion's 
Driver Game Core: 'Keyboard Repair •Fixing the Applesoft 
Sample Disk 



December 1986 Softkeys: 'Cycled 'Alternate 
Realty 'Boulder Dash I & II 'Hard Hat Mack (Revisited) 'The 
Other Side 'F-15 Strike Eagle 'Championship Lode Runner 
'Gate V 1.3 •!, Damiano •Wilderness •Golf's Best Features: 
'The Enhanced/ Unenhanced //e 'Looking into Flight 
Simulator's DOS Core: 'Appavarex •Installing a RAM disk into 
DOS 3.3 



Slate 'Alter Ego 'Rendezvous 'Quicken 'Story Tree 'Assembly 
Language Tutor 'Avalon Hill games •Dark Crystal Features 
•Playing Karateka on a //c •Track Finder 'Sylk to Dif Core: 
•Breaking In: tips for beginners •Copy ]| Plus 6.0: a review •The 
DOS Alterer 



October 1986 Softkeys: •Flight Simulator II v 
1.05 •AutoDuel 'Critical Reading 'Troll's Tale 'Robot War 
'General Manager 'Plasmania 'Telarium Software 'Kidwriter 
v1 .0 •Color Me Features 'Screenwriter meets Flashcard 'The 
Bus Monitor •Mousepaint for non-Apples Core: 'The Bard's 
Dressing Room /l/T 'Championship Lode Runner 



September 1986 5o/ife>s.- 'Olympic Decathlon 
'Hi-res Cribbage 'Revisiting F-15 Strike Eagle 'Masquerade 
'The Hobbit 'Pooyan 'The Perfect Score 'Alice in Wonderland 
'The Money Manager 'Good Thinking 'Rescue Raiders 
Feature: Putting a New F8 on Your Language Card Core: 
•Exploring ProDOS by instaling a CPS Clock Driver 



August 1986 Softkeys •Crisis Mountain •Terripin 
Logo •Apple Logo II 'Fishies 1.0 'SpellWorks 'Gumball 
'Rescue at Rigel 'Crazey Mazey 'Conan 'Perry Mason: The 
Case of the Mandarin Murder 'Koronis MFeature: 'More ROM 
Running Core: 'Infocom Revealed 



July 1986 Softkeys 'Word Juggler 'Tink! Tonk! 
•Sundog v2.0 •G.I. Joe & Lucas Film's Eidolon •Summer 
Games II •Thief •Instant Pascal •Worid's Greatest Football 
Game 'Graphic Adventure #1 'Sensible Grammar & Extended 
Bookends 'Chipwits 'Hardball 'King's Quest II 'The World's 
Greatest Baseball Game Feature: 'How to be the Sound Master 
Core: 'The Mapping of Ultima IV 



June 1986 Softkeys 'Revisiting Music 
Construction Set 'Cubit 'Baudville Software 'Hartley Software 
•Bridge •Early Games for Young Children 'Tawala's Last 
Redoubt •Print Shop Companion •Kracking Vol II •Moebius 
'Mouse Budget, Mouse Word & Mouse Desk 'Adventure 
Construction Set Feature: 'Using Data Disks With Microzines 
Core: 'Super lOB v1.5 a Reprint 

^S 1 May 1986 Sj^A^e^s 'Trivia Fever 'The Original 
Boston Computer Diet 'Lifesaver 'Synergists Software 'Blazing 
Paddles •Zardax •Time Zone "Tycoon "Earthly Delights •Jingle 
Disk 'Crystal Caverns 'Karate b\\w\'p Feature: 'A Little Help 
With The Bard's Tale Core: 'Black Box 'Unrestricted 
Ampersand 



April 1986 Softkeys 'Millionaire 'SSI's RDOS 
'Fantavision 'Spy vs. Spy 'Dragonworld 'King's Quest 
•Mastering the SAT •Easy as ABC •Space Shuttle •The Factory 
•Visidex LIE •Sherlock Holmes •The Bards Tale 'Feature 
•Increasing Your Disk Capacity *Core: •Ultimaker IV, an Ultima 
IV Character Editor 



March 1986 Softkeys 'Threshold 'Checkers 
v2.1 'Microtype 'Gen. & Organic Chemistry Series •Uptown 
Trivia •Murder by the Dozen •Windham's Classics •Batter Up 
•Evelyn Wood's Dynamic Reader 'Jenny of the Prairie 'Learn 
About Sounds in Reading 'Winter Games 'Feature 
•Customizing the Monitor by Adding 65C02 Disassembly 'Core: 
•The Animator 



November 1986 Sdtkeys: 'Under Rre 'Pegasus 
][ 'Take 1 (revisited) 'Flight Simulator II vl.05 (part 2) 'Magic 



February 1986 Softkeys 'Ultima IV 'Robot 
Odyssey 'Rendezvous 'Word Attack & Classmate »Three from 
Mindscape 'Alphabetic Keyboarding 'Hacker 'Disk Director 
'Lode Runner 'MIDI/4 'Algebra Series 'Time is Money 'Pitstop 
II 'Apventure to Atlantis 'Feature 'Capturing the Hidden Archon 



Editor 'Core: 'Fingerprint Plus: A Review •Beneath Beyond 
Castle Wolfenstein (part 2) 



January 1986 Softkeys 'Microzines 1-5 
'Microzines 7-9 | Microzines (alternate method) 'Phi Beta Filer 
•Sword of Kadash 'Another Miner 2G49er 'Learning With 
Fuzzywomp 'Bookends 'Apple Logo II 'Murder on the 
Zindemeuf 'Feature 'Daleks: Exploring Artificial Intelligence 
•Making 32K or 16K Slave Disks 'Core: 'The Games of 1985: 
part II 



Softkeys 'Cannonball Blitz 'Instant Recall 
'Gessler Spanish Software 'More Stickybears 'Financial 
Cookbook 'Super Zaxxon 'Wizardry 'Preschool Fun 'Holy Grail 
•Inca '128K Zaxxon 'feate'ProEdit 'Core: 'Games of 1985 
parti 



Softkeys 'DB Master 4.2 'Business Writer 
•Ban'on's Computer SAT 'Take 1 'Bank Street Speller 'Where 
In The World Is Carmen Sandiego 'Bank Street Writer 128K 
•Word Challenge •Spy's Demise •Mind Prober •BC's Quest 
For Tires •Eariy Games 'Homeword Speller 'Feature 'Adding 
IF THEN ELSE To Applesoft 'Core: -DOS To PtoDOS And Back 



Softkeys •Electronic Arts software •Grolier 
software •Xyphus •F-15 Strike Eagle Hnjured Engine 'Mr. Robot 
And His Robot Factory •Applecillin II •Alphabet Zoo •Fathoms 
40 •Story Maker •Early Games Matchmaker •Robots Of Dawn 
'Feature •Essential Data Duplicator copy parms 'Core: •DOS- 
Direct Sector Access 



Softkeys •Choplifter •Mufplot •Flashcalc 
•Karateka •Newsroom •E-Z Draw •Gato •Dino Eggs 'Pinball 
Construction Set 'TAC 'The Print Shop: Graphics Library 
•Death In The Caribbean 'Features •Using A.R.D. To Softkey 
Mars Cars •How To Be The Writemaster 'Core: •Wheel Of 
Money 



Softkeys '\K\m 2049er •Lode Runner •A2-PB1 
Pinball •The Heist •Old Ironsides 'Grandma's House 'In Search 
of the Most Amazing Thing 'Morloc's Tower 'Marauder •Sargon 
III 'Features •Customized Drive Speed Control •Super lOB 
version 1.5 'Core: •The Macro System 



Softkeys •Sargon III •Wizardry: Proving Grounds 
of the Mad Overlord and Knight of Diamonds 'The Report Card 
VI. 1 'Kidwriter 'Feature 'Apple ][ Boot ROM Disassembly 
'Core: 'The Graphic Grabber v3.0 'Copy 11+ 5.0: A Review 
'The Know-Drive: A Hardware Evaluation 'An Improved 
BASIC/Binary Combo 



5o/iite>s "Rendezvous With Rama'Peachtree's 
Back To Basics Accounting System 'HSD Statistics Series 
'Arithmetickle 'Arithmekicks and Eariy Games for Children 
'Features 'Double Your ROM Space 'Towards a Better F8 
ROM 'The Nibbler: A Utility Program to Examine Raw Nibbles 
From Disk 'Core: 'The Games of 1984: In Review-part II 



Softkeys 'Sensible Speller for ProOOS 'Skteways 
'Rescue Raiders 'Sheila 'Basic Building Blocks 'Artsci 
Programs 'Crossfire 'Feature 'Secret Weapon: RAMcard 
'Core: 'The Controller Writer 'A Fix For The Beyond Castle 
Wolfenstein Softkey 'The Lone Catalog Arranger Part 1 

1 Softkeys 'Data Reporter 'Multiplan 'Zorit 'Features 
'FARMS for Copy II Plus 'No More Bugs 'APT's for Choplifter 
& Cannonball Blitz ''Copycard' Reviews 'Replay 'Crackshot 
'Snapshot 'Wildcard 
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Out-of-print back issues 



To order, Use the back issue order form on page 42 



Due to popular demand, these sold-out issues are available now as 'zeroxed' copies, full-sized and center stapled. 



^S 1 USoftkeys: "DB Master version 4+ "Dazzle Draw 'Archon 
•Twerps UReaders ' Softkeys: "Advanced Blackjack 'Megaworks •Summer 
Games •College Entrance Exam Prep "Applewriter revisited UFeatures: 
•Demystifying The Quarter Track ■ Core: •Proshadow: A ProDOS Disk 
Monitor 



lO 



USoftkeys: 'Scholastic Version of Bank Street Writer 
•Applewriter He 'SSI's Non-RDOS Disks MReaders' Softkeys: 'BPI 
Accounting Programs and DesignWare Programs MFeatures: •Installing 
a Free Sector Patch Into Applewriter He •Simple Copy Protection ■ Core: 
•The Games of 1 984: In Review •65C02 Chips Now Available •Checksoft 
v2 



USoftkeys: "The Print Shop •Crossword Magic •The Standing 
Stones 'Beer Run •Skyfox •and Random House Disks UFeatures: •A 
Tutorial For Disk Inspection and the Use Of Super lOB •S-C Macro Assembler 
Directives (reprint) ■ Core: 'The Graphic Grabber For The Print Shop •The 
Lone Catalog Arranger Part Two 



USoftkeys: •Mastertype 'Stickybear BOP 'Tic Tac Show 
UReader's Softkeys: •The Financial Cookbook •Escape from Rungistan 
•Alien Munchles •Millionaire •Plato UFeatures: •MREAD/MWRT Update 

■ Core: 'A Boot from Drive 2 'DB Master's Data Compression Techniques 

■ Whiz Kid: 'DOS and the Drive - Part One UAdventure Tips: •Time 
Zone 'Mission Asteroid •Enchanter •Zork I •Ultima • Ultima II 'Death 
In the Caribbean •Gruds in Space •Zork III •Starcross 



UFeatures: •Super lOB v 1 .2 Update •Putting Locksmith 5.0 
Fast Copy Into a Normal Binary File •Batman Decoder Ring •A fix for 
DIskEdit USoftkeys: •Seadragon •Rocky's Boots •Knoware 'PES Software 
'Computer Preparation SAT 'MatheMagic UReview: 'Boulder Dash 



ISoftkeys: 'Arcade Machine 'Bank Street Writer 'Minit Man 
UReader's Softkeys 'Senible Speller IV 'EDD IV ''Krell LOGO 'Canyon 
Climber UFeatures: 'The Controller Saver 'Examining Protected Applesoft 
BASIC Programs 'Crunchlist II UCore: 'Applear - Voice Aynthesis 
'Introducing the 65SC802 and 65SC8 1 6 Chips 'Review ■ Dino Eggs 
UAdventure Tips: 'Cranston Manor 'Zork I 'Planetfall 'Mission Asteroid 
'Time Zone 'Suspended 'Critical Mass 'Zork II 'Castle Wolfenstein 



Sy USoftkeys: 'Sensible Speller 'Sierra-On-Llne Software 'The Visible 
Computer: 6502 UReader's Softkeys: 'VIsidex 'Music Construction Set 
'Gold Rush 'VIslterm 'Cosmic Combat ■ Features: 'Super lOB 
UAdventure Tips: 'Pirate Adventure 'Mask of the Sun 'Colossal Caves 
'Transylvania 'Death in the Caribbean 'Zork II HCore: 'Word Search 
Generator 'ProDOS to DOS 'ProDOS on a Franklin Ace 



CS USoftkeys: 'Robotron 'Legacy of Llylgamyn 'The Artist 'Data 
Factory v5.0 ' EDD IV UReader's Softkeys: 'Spy Strikes Back 'Hayden 
Software 'Apple LOGO UFeatures: 'Review of the Bit Copiers UCore: 
'COREfller 'ProDOS Data Encryptor UAdventure Tips: 'Ulysses and The 
Golden Fleece 'Serpentine 'Ultima II 'Castle Wolfenstein 'Death in the 
Caribbean 'Zork I 'Zork II 'Gruds in Space 'Enchanter 'Infidel 'Serpent's 
Star ■ Whiz Kid: 'How Data is Stored on Disk 



M USoftkeys: 'Zaxxon 'Mask of the Sun 'Crush 'Crumble S Chomp 
'Snake Byte 'DB Master 'Mouskattack UFeatures: 'Making Liberated 
Backups That Retain Their Copy Protection 'S-C Assembler: Review 'Disk 
Directory Designer UCore: 'COREfiler: Part I 'Upper S Lower Case 
Output for Zork 



W9 USoftkeys: 'Pandora's Box 'Donkey Kong 'Caverns of Freltag 
'VIslflle UFeatures: 'Program Enhancements: QuIck.Bug 'Personalizing 
A Program 'Modified ROMs UReview 'Essential Data Duplicator 'The 
CIA UCore: 'Data Bases 



USoftkeys: 'Laf Pak 'Beyond Castle Wolfenstein 
'Transylvania 'The Quest 'Electronic Arts 'Snooper Troops (Case 2) 'DLM 
Software 'Learning With Leeper 'TellStar UCore: 'CSaver: The Advanced 
Way to Store Super lOB Controllers 'Adding New Commands to DOS 3.3 
'Fixing ProDOS 1 .0. 1 BSAVE Bug UReview: 'Enhancing Your Apple 
UFeature: 'Locksmith 5.0 and Locksmith Programming Language. 



i^ USoftkeys: 'Homeword 'Aztec 'tBag of Tricks 'Egbert II 
'Starcross 'Hard Hat Mack 'The Home Accountant UReader's Softkeys: 
'Dark Crystal 'Screenwriter II 'Vlsifile 'Lancaster 'Bill Budge's Triolgy 
of Games 'Sammy Lightfoot 'Amper-Magic 'Buzzard Bait UFeature: 
'Getting on the Right Track 



USoftkeys: 'Zoom Graphlx 'Flip Out 'Lion's Share 'Music 
Construction Set UReader's Softkeys: 'Hi-Res Computer Golf II 'Suicide 
'Sabatage 'Millionaire 'Time is Money 'Type Attack U Features :Pseudo- 
ROMs on the Franklin Ace UCore: 'Psychedelic Symphony 'The CORE 
Disk Searcher 'The Armonitor UAdventure Tips: 'Cranston Manor ' 
Enchanter 'Kabul Spy 'Colossal Caves 'The Witness 'Pirate Adventure 
•Ultima Ill-Exodus •Adventureland 



1 1 USoftkeys: •Sensible Speller 'Exodus: Ultima III UReaders' 
Softkeys: 'SoftPorn Adventure 'The Einstein Compiler v5. 3 'Mask of The 
Sun UFeatures: 'Copy II Plus v4.4C: Update Of An Old Friend 'Parameter 
List For Essential Data Duplicator UCore: 'Ultlmaker III 'The Mapping 
of Ultima III 'Ultima II.. .The Rest Of The Picture 



TE UFeatures: Ultima II Character Editor USoftkeys: 'Ultima II 
'Witness 'Prisoner II 'Pest Patrol UAdventure Tips: 'Ultima II g III 
■Copy II Plus Parms Update 

^i USoftkeys: 'Bag of Tricks 'Multiplan UReaders' Softkeys: 
'Vislplot A/isltrend 'Sneakers 'Wizardry UFeatures 'No More Bugs: The 
Sequel 'Hidden Locations Revealed 'Map Maker UA.P.T.s 'Chopllfter 
UAdventure Tips 'Cranston Manor 'Strange Odyssey 



4h USoftkeys: 'Magic Window II 'Multiplan UFeatures: 'Parameters 
for Locksmith 4.1 'Page Flipper 'String Plotter 'Three-D Wall Draw 
UCore: Checksums Ulnput: 'Reviews of unprotected commercial software 
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Beit of Hardcore Compntiiig. . • dl • 

Only the disk I* available 

Core SpecU Combo $10 □ • • 

(Ail three CORE magazines; no disks) 

Some disks apply to more than one issue and are shorn as taller tnxes. 
Special "Both" disk & magazine comljination oideis apply to one issue 
and \k corresponding disk. 

■tr Limited supply: first-come-first-serve basis. 

• Not available. 
O Out-of-print; only 'Zeroxed' copies for sale. 



COlVirUTIST 

back issues and library disks are 
frequently referenced in current issues. 



Back Issues and Library Disk Rates 



• US, Canada and Mexico back issue rate - $4.75 each. 

• All other Foreign back issue rate - $8.75 each. 

• US, Canada, Mexico library disk rate - $9.95 each. 

• All other Foreign library disk rate - $11.94 each. 

• "Both" disk and magazine rates for: 

US, Canada & Mexico - $12.95 each combination. 
All other Foreign - $18.95 each combination. 

Wkud l5 a Cibfuvu^ dUWi 

A library disk is a diskette that contains programs that would normally have to be typed in by 
the user. Documentation for each library disk can be found in the corresponding issue. 

• Library disks are available for all issues of COMPUTIST # 1 thru 6 1 . If you wish to purchase 
a library disk not listed on the left (under the DISK column), used the out-of-print back issues 
ad on page 42. 

CiMtc|iCeie you^ C^W2cUjo*d 

Cr^^SKE 3 Games: constructing Your own joystick* compiling Games* C^MEytE^/ElfS: 
Over 30 of the latest and best* Pick Of The Pack: All-time TOP 20 games* Destructive Forces* EAMON* Graphics Magician 
and GraFORTH* Dragon Dungeon 

Cr^^l^E 2 Utilites: Dynamic Menu* High Res: Scroll Demo* goto label: Replace* Line 
Find* Quick Copy: Copy* 

Cv^^l^E 1 Graphics: Memory Map* Text Graphics: Marquee* Boxes* Jagged Scroller* Low 
Res: Color Character Chart* High Res: Screen Cruncher* The UFO Factory* Color* Vector Graphics:Shlmmering Shapes* 
A Shape Table Mini-Editor* Bkjck Graphics: Arcade Quality Graphics for BASIC Programmers* Animation 



Name. 



. ID#. 



Address 



City 



State 



Zip 



Country . 



. Phone . 



Exp. 



Signature. 



.CP61 



• US funds drawn on US bank. • Most orders shipped within 5 working days, however please allow up 
to 4 weeks delivery for some orders. • Most orders shipped UPS, so please use street address. • Offer 
good while supply lasts. • In Washington state, add 7.8% sales tax. • Send check/money order to: 

COMPUTIST PO Box 110846-T Tacoma, WA 98411 (206)474-5750 
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the COMPUTIST shopper 



Software Package lie 1 1 gs 

816 Paint $45,000 $45,000 

Alternate Reality: The Dungeon $28.00 D 

Altemate Reality: The City $20.00 D 

Appleworks $190.00 D 

Artie Fox $28.00 D 

Bank Street Writer 64K $46.00 D 

Bank Street Writer Plus (128K) $46.00 D 

Bard's Tale $30.00 D $35.00 D 

Bard's Tale U $35.00 D 

Sard's Tale ra $35.00 D 

California Games $26.00 D $26.00 D 

Certificate Maker $25,00 

Championship Karate $14.00 D 

Chessmaster 200© $28.00 D 

Clip Art Library (for Paintworks Plus) . . $20.00 D 

Copy n Plus v8.0 $23.00 D $23.00 D 

Create with Garfield $200© D 

Create w/ Garfield Deluxe $28.00 D 

Crossword Magic $32.00 D 

Dark Lord $15.00 D 

Dazzle Draw $40.00 D 

Deathtord $28.00 D 

Draw Plus $52.00 D 

F-15 Strike Eagle $24.00 D 

Fantavision $34.00 D $40.00 D 

FUght Simulator n $36.00 D 

Force 7 $15.00 D 

Halls of Montezuma $28.00 D $28.00 D 

Hardball $22,00 $28.00 D 

Hitchhiker's Guide $20.00 D 

Jet $29.00n 

Karateka $24.00 D 

King's Quest $32.00 D $32.00 D 

; Quest n $32.00 D $32.00 D 

1 Quest ffl $32.00 n $32.00 D 

King's Qutet IV $32.00 D 

Knight of Diamonds.. $23.00 D 

Legacy of the Ancients $28.00 D 

Legacy of Llylgamyn $26.00 D 

Leisure Suit Larry $26,00 $26,00 

Lode Runner $24.00 D 

Macroworks $20.00 D 

Math Blaster $28.00 D 

Math Blaster Plus 29.00 D $29.00 D 

Math Rabbit $27.0© D 

Math Talk $35.00 D 

Marble Madness $25.00 D $25.00 D 

Mean 18, Ultimate Golf $28.00 D 

Merlin 8/16 $8©0© D 

Millionaire 11 $40.00 D 

Mousewrite $99.00 D $99.00 D 



$66.00 D 



$120.00 D 
$47.00 D 
$65.00 D 

$40.00 D 



Software Package He 11 gs 

Multiscribe 3.0 $48.0© D 

Music Studio 2.0 $52.0© D 

Newsroom $38.00 D 

Paint Write Draw 

Paintworks Plus 

Paintworks Gold 

Pegasus $23.00 D 

The Print Shop $34.00 D 

Print Shop Companion $27.00 D 

Print Shop Grapliics Library: 

Disk One $16.50 D 

Disk Two $16.50 D 

Disk Three $16.50 D 

Pro-Byter $32.0© D 

Reader Rabbit $27,00 $34.00 D 

Silent Service $23.00 D 

Space Quest $32.00 D $32.00 D 

Space Quest II $32.00 D 

Star Fleet $35,00 

Star Trek- The Kobayashi Alternative . . $27.00 D 

Star Trek II- The Promethean Prophecy $27.0© D 
Stickybear Series: 

ABC's $24.00 n 

Math I $24.00 n 

Math n $24.00 D 

Numbers $24.00 D 

$24.00 D 

$24.00 n 

Typing $24.00 D 

C^posites $24.00 D 

Thexder $23,00 $23.0© D 

TimeOut Superfonts $42,00 

Tomahawk $23.00 D 

Topdraw $66.00 D 

Type $3©0ffl D 

Typing Tutor IV $32,00 $32,00 

Ultima V $40,000 

Visuahzer $53.00 O $59.00 O 

Where in USA is Carmen San Diego ... $300© O 

Where in World is Carmen San Diego. $3©0© O 

Where in Europe is Carmen San Diego $3©.0© O 

Wings of Fury $25.0© O 

Winter Games $25.©0O $27,00 

Wizardy...: $32,00 

Word Attack $28.00 O 

WordPerfect w/ Spelng Checker- $95.00 O $95.00 D 

World Games $25,00 $27,00 

Writer's Choice Eble. $60.00 O 

Writer Rabbit $24.00 D 

Yeager's Advanced Flight Trainer $28.00 D 



Name 






in* 




Address 










City 
Country 

s m 




State 7.ip 
Phone 


Rxn. 




Signature 








rpfii 




SoftKey Publishing 


PO Box 110816-T Tacoma WA 


98411 





COMPUTIST 
is proud to 
offer these 
LOW software 
prices* for 
Apple II and 
llgs software 



* Prices subject to 
change without notice. 

Because we do not 'stock' but 
order or)ly the software needed, 
the COMPUTIST Shopper keeps 
operating costs to a minimum 
and can pass the savings on to 
you. 

In most cases, your order is 
shipped within two weeks. The 
COMPUTIST Shopper will NOT 
cash your check nor charge 
your credit card until your 
software is ready to be shipped. 
If the software you ordered is 
not available, you will have the 
option to cancel your order, or 
make an alternative selecthn. 



How To Order 



• US orders: Check the box for 
youi selection. For Apple Hgs 
software, check the box in the 
right-hand column. 

• Please add $3 per order for 
shipping St handling. Orders over 
$200 receive free shipping. 

• Most orders shipped UPS, so use 
your street address. 

• Washington state, please add 
7.8% sales tax. 

• Offer good while supphes last. 

• Foreign Orders: Please inquire 
as to appropriate shipping fees 



• Software 
SUBTOTAL _ 

• Plus 
SHIPPING _ 
(see above) 

• WA residents 
Sales Tax _ 
7.8% 

■ TOTAL 
Enclosed 
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IBM Reader's Data E3Cchaiige IBIMI 



Meal Jhala 



Softkey for.. 



Test Drive 

Accolade 



This softkey works for TDCGA.EXE 
dated 10/26/87 4:43 PM. It removes all copy 
protection from the program. We will use 
DEBUG for this. 

From the DOS prompt: 
REN TDCGA.EXE PROGRAM 
DEBUG PROGRAM 

Now you're in DEBUG. 
D 700615 

You should see 55 56 57 06 IE. If not then 
you have a different version. (See note.) 

E 70D6 31 CO C3 
D70D6LS 

You should see 31 C0 C3 06 IE. 

W 

You should see Wr i t i ng E080 bytes. 



Now you're back in DOS. 
REN PROGRAM TDCGA.EXE 

NOTE: If your version Js different or you 
wish to patch the EGA version of 
TDCGA.EXE, search for the hex string 55 
56 5706 IE and try changing it to 31 C0C306 IE. 
It will probably work. 



C.J. Blanchard 



I recendy acquired an AE PC Transporter 
which is a super addition to my Ilgs as it 
allows me to take work home when necessary. 
All of the software that I have tried — DBase 
m, Woidstar, Windows, PC Paint, Printshop, 
Sidekick, Enable and Grand Slam Bridge — 
has run without a hitch except Gunship. 

(5) Gunship by Microprose runs well 
enough but the highlighted menu bars don't 
work for some reason. The copy protection 
is well beyond my skill. I have been reading 
thru the IBM RDEX to see if someone else 
has solved this problem. The protection seems 
to revolve around bad blocks. There are no 
"INT 13" codes in the GS.COM file but the 
code is self modifying. While I do not 
understand 8086 code, running GS.COM 
with DEBUG and then retracing the code 
produces many "INT 13" instructions. 
(Thanks to David Alexander and his 
"Introduction to IBM Disk Format, Access 
and Copy Protection", I refer to it often.) If 
someone has a fix or crack for this program, 
I would appreciate hearing fi-om you. 



Keep the IBM RDEX going. I would be 
interested in a DEBUG tutorial, IBM 
Softswitch or other important locations and 
general machine language tips. 



Kevin Dobbins 



Protected files 

I've been working for a local computer 
dealer for a few months as a support and 
training technician. One day, a saleman 
challenged me to list one of his small batch 
files. I used the "TYPE" command and got 
a "File Not Found" error. He laughed and 
walked away. After some time, I discovered 
his clever security lock. In place of a character 
in the filename (or extention) , he typed ' 'ALT 
KEY" -255. This had the effect of printing 
a blank in a directory listing. By extending 
this idea, you could make a filename extention 
be invisible, or, by using ASCII codes 
126-255, make a disk appear to be garbage 
when it is really OK. This idea even works 
with sub-directory names. The possibilities 
are limitless! Maybe this is a well-known 
security device for file names, however, I 
thought it was interesting. 



Mike Basford 



MS DOS Copy Protection 

The tide against copy protection is heavy 
in the IBM field, with more and more 
magazines recommending people don't buy 
protected software. More companies each 
month drop protection, although some of the 
alternatives are pretty strange. 

For the remaining copy protected 
software, here are some heavyweight tools of 
the trade, all of which I have and recommend. 

The number one tool is from our friends 
at Central Point Software (CPS), the Option 
Board. This is inserted between the floppy 
controller and the drives, and will copy any 
disk. I have found a couple that gave me a 
hard time, but they fell to Copy II PC, also 
from CPS. By the way, the Option Board will 
copy most floppy disks, even if they am't IBM 
(are you reading this Apple people?) I 
sometimes have to recopy track $00 with 
Copy n Plus. A further feattire of this amazing 
piece of hardware, is that it copies MAC disks 
(as well as copying files to and from MAC 
- IBM). It has all sorts of nice utilities such 
as disk editors etc.. 

Copy n PC will copy many disks, but it's 
best feature is a program called NOGUARD. 
This will determine the type of protection 
used, and, in many cases, deprotect it! 

Other than these, I use several public 

domain programs obtained from your local 

I BBS. These include CRACKER (a de- 



compiler that generates commented source 
code from programs), FSDEBUG (an 
excellent replacement for DOS's DEBUG), 
various memory mapping programs and, of 
course, PC TOOLS! 

Words words words 

, I recently met a key programmer from 
one of the largest game software companies, 
and had an interesting chat. He was on 
Vancouver Island for the "Worlds Best 
Fishing". We talked a littie about graphics, 
"C" programming, copy-protection, etc. 

Ally way , it seems that we have beaten the 
protectors, and there should be virtually NO 
copy protection in a year or so. I hope 
COMPUTIST changes its format enough to 
survive in those times! 

He told me that the main problem that the 
software companies have, is with the people 
who openly advertise pirated software for 
sale. They are difiiicult to catch and prosecute, 
and cost companies lots in lost sales. He was 
not concerned with collectors and traders of 
software, since most of their software would 
never have been purchased in the first place. 

He also said diat the restrictions of having 
to produce their software in 128K versions (ie: 
Apple II) held back better graphics. It seems 
that everyone is waiting for memory prices 
to come back down to Earth, and the 
requirements for State of Art (instead of. State 
of Ark) systems will be 30 - 50 MHz 
processors, with a minimum of 16 Megabytes 
of RAM. If the operating system of choice is 
Unix or similar, programs can quickly be 
ported between any two machines. We wifl 
see less differences between computers, as the 
best things from each system are ported to all 
others. 

Of course, this will cause even more 
pressure for un-protected software, and any 
remaining vestiges will quickly be swept 
away. , 

I hope that this generates some replies, 
and maybe we could have a column where we 
discuss general subjects, much like a BBS in 
print? And please keep up the technical, and 
hardware related articles. Even if I don't 
actually build them, they provide some insight 
into the inner workings of my favorite 
machines! 

Playing Tips for... 



Leisure Suit Larry in the 
Land of the Lounge Lizards 



Sierra On-Line 



In order to by-pass the annoying questions 
at the start of Land of the Lounge Lizards, 
type in your age, (lie, if you like!), and then 
answer the first question with ALT-X. 
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Softkey for.. 



Print Shop 

Broderbund 



There are several versions of Print Shop 
around, and I'll tell you how to crack a couple 
of them. A third, more recent, copy is quite 
different, and I'm still working on it! 

PS. EXE has the first layer of protection, 
and when it is removed, the program will run. 
However, when the program is run from hard 
disk, PSINIT.OVR has to be cracked too. 

Before you start, use DISKCOPY to 
back-up the disk. Don't work on the original 
disk! Also, since DEBUG won't work with 
.EXE files, rename PS.EXE to PS before you 
start. 



RENAME PS.EXE PS 
DEBUG PS 
SO MOO CD 13 

XXXX:3AC6 
XXXX:3ADF 



Start DEBUG 
Search for INT 13 

These are the Interrupts 
that I found. 

Unassemble code to check it 



U3AC6 

XXXX:3AC6 INT \2 Test fordisk 

XXXX:3AC8 MOV BYTE PTR [0A91] ,02 

XXXX:3ACD DEC BYTE PTR [0A91] 

XXXX:3AD1 JZ 3AE6 

XXXX:3AD3 MOV DH,00<_ 

XXXX:3AD5 MOV DL,00 

XXXX:3AD7 MOV CW,fi9lMkfor special nibble track 

XXXX:3AD9 MOV CL,0A 

XXXX:3ADB MOV AL,01 

XXXX:3ADD MOV AH, 04 

XXXX:3ADF INT 13 <_ 

XXXX : 3AE1 CMP AH , 00 Compare, and crash if not there 

XXXX:3AE4 JNZ 3ACD 



A3AC6 

XaaC:3AC6 NOP 
XXXX:3AC7 NOP 
XXXX:3AC8 



Get rid of disk check 



A3AD D actual test of disk 

XXZZ:3ADD MOV AH.OO required by AH register 

XXn ;3ADF NOP 

n« :3AE0 NOP Get rid of disk check 

XXXX:3AE1 

W Write changes to disk 

Q Quit DEBUG 

RENAME PS PS.ZAP Rename program to run 

Print Shop will now run on a floppy. 

Part 2 for hard disk users 



DEBUG PSmiT.OVR 
so 2000 CD 13 

XXXX: 0479 
XXXX: 0492 
XXXX:04BD 
XXXX :1 ADD 
XXXX:1AF6 



DEBUG copy of program 
Look for Interrupt 13's 



These 3 on second version I tried 



XXXX:1B21 
U0479 



XXXX 
XXXX 
XXXX 
XXXX 
XXXX 
XXXX 
XXXX 
XXXX 
XXXX 
XXXX 
XXXX 
XXXX 
XXXX 



Look for special nibble track 



0479 INT 13 Look for disk in A 
047B MOV BYTEPTR[CD57],02 

0480 DEC BYTE PTR [CD57] 
0484 JZ 04DB 

0486 MOV CL,11<- 

0488 MOV AH, 04 

048A MOV DH,00 

048C MOC CH,09 

048E MOV DL,00 

0490 MOV AL,01 

0492 INT 13 <- 

0494 CMP AH, 00 Do the check 

0497 JNZ 0480 and crash if not there 



U04BO 

XXXX:04BD 
XXXX:04BF 
XXXX:04C2 
XXXX:04C4 
XXXX:04C8 
XXXX:04C8 
XXXX:04CB 
XXXX:04CD 
XXXX:04CF 
XXXX:04D1 
XXXX:04D2 
XXXX:04D4 
XXXX:04C6 
XXXX:04D9 



INT 13 
CMP AH, 00 
JNZ 04A5 
ADD BX,0I8B 
MOV CL,05 
ES: 

MOV CL,[BX] 
CMP AL,41 
JNZ 04DB 
INC BX 
DEC CL 
JNZ 04CA 
MOV AX, 0000 
JMP 04DE 



Same old thing 



A 0479 

XXXX:0479 NOP 
XXXX:047A NOP 
XXXX:047B 



if check is OK 
Jump to start 



Remove Interrupt 13 



Ae49e 

XXXX:0490 MOV AH.OO required by AH register 



XXXX:0492 NOP 
XXXX:0493 NOP 
XXXX:0494 

A04BD 

XXXX:04BD JMP 04D6 

XXXX:04BF 



Remove Interrupt 13 



Jump past check to start 
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(On the second copy of PS I looked at, 
there was a second copy of this code at 
lADD, 1AF6 and 1B21. If you have this, 
simply repeat above modifications, with the 
appropriate address changes.) 

One further modification is optional. The 
program will still ask you to put the original 
disk in A:, although it doesn't check. You 
may use PCTOOLS, or simular, to search for 
this message, and remove it. Leave the "Press 
any key" message in though, or the user 
won't know why the program is just sitting 
there. 

Have fun! 
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At last, I'm starting to recieve some letters. 
Let's keep on writing with the latest tips and 
techniques. Some of that 3 and 4 year old BBS 
data was really questionable. I'm sure there are 
okt versions oif popular programs fhating around 
but most of us have the latest version of any 
program that we use a lot. 

This issue marks the first entry in the IBM 
Most Wanted List. If you're having a problem 
backing up a program, tell us so we can add it 
to the list. 

I'd like to put together a FREE Starter Kit 
for us IBM users. If you have any Public Domain 
Software (PDS) that you would like to donate, 
how about sending it to me. No copyrighted 
software please. 

Aboveall, send letters telling about any neat 
and nifty things that you have learned. The more 
you write, the more others will write. We need 
to expand these pages and that's the only way 
to do it. ...RDEXed 

Send all contributions to: 

IBM-RDEX editor 

COMPUTIST 
PO Box 110846-T 
Tacoma, WA 98411 



MOST 

WANTED 



Gmsidp Microprose 



45 



unCLASSIFIED ADS 



Trade your unwanted software. 
Send your list of programs to 
trade. I have over 7® originals to 
trade. Byron Blystone, P.O. Box 
1313, Snohomish, WA 98290). 



PUBUC DOMAIN 

Plus morel I! 
loo's of disks. KDOCs of PRINT 
SHOP grahics, APPLEWORKS files, 
PRODOS files, EDUCATIONAL, 
UTILITIES, plus much more. 
School purchase orders welcome. 
Send $1 for catalog to Continentsd 
Software Co., Box 1511, So. Glens 
Falls, NY 12803 



HackerDOS 

Fast DOS 3.3 plus undelete, space 
on disk, print text file to 
screen/printer, fast text I/O, addr. 
& length of loaded files, hex/dec 
translation, 15 more sectors/disk. 
Nothing removed, takes no extra 
spacel Support progreuns copy 
any range of sectors, change 
lower -♦ uppercase, & customize 
DOS. Options incl. binary/text 
boot file, show deleted files, >35 
tracks, & 2-colimm catalog. $5 to: 
Phil Goetz 

4©23 Huckleberry Row 
Ellicott City, MD 21(Z>43 



The COMPUnST SUPER INDEX 

now has over 32<ZXZ> records and 
14,0(ZXD entries! Three colossal 
data bases (15 fields each) list 
every item ever published in 
COMPUnST. See advertisement 
- issue #57, page 45. Prices good 
through 12/31/88, D.R. Hopkins, 
3495 W. Hoye PI. Denver, CO 
80219 

Original Apple Software 

New and used. Tiade/sell. Over 
1(ZKZ> games and adventures. Also 
GS software, hardware, Euid misc. 
Send stamp for list. Steve 
Wadsten, 20)318 Fremont, 
Livonia, MI 48152 



How to place an Unclassified Ad 

For short ads, use this ozdm fonn. For laiger ads, submit typed copy with appiopiiate 
instructions. Use every character space, up to 30 characters per tine, we will adjust 
word wrap. $5 for the first tine, $1 per tine after that. 

Sptdal Graphics Instmctioiis: The first three words of the first line are printed in bold 
for bee. If you want other words bolded, use two spaces per letter and circle the entire 
word. (Bold letters count as two letters.) If you want a tine centered, write CENTER 
next to that tine. There is no charge for centering any tine. 

. $5 

t6 

$7 

. $« 

: $9 

$10 



-HW- 



aty 

Country . 



Zip 



Signature^ 



Total Number of lines: 



CP63 

.00 



Run my ad . 



. nund>er of times. Each run that I pay 
for now will cost me only ^h the total initial cost. 

Total 

'Washington orders add 7.8% sales tax. 

Final Total 

Send this form and a check or money order (funds drawn on US bank only) 
for the entire amount to: 

COMPUTIST unCLASSIFIEDS PO Box 11084« Tacoma, WA 984U 




Sound System ™ 2 

NEWI Z-Way StirM AmplUieil Speakar Syttam 
for yaur Appla llgt. Na. lie. II+. and MacintMh 



MEGABYTE RAM BOARDS! 

Tha Ultimata in RAM Pawarl 
Supar Expandar 6S, a 100% replace- 
ment for Apple llgs 1 meg board. 
Fully llgs hardware & software 
compatible. fK $39 

Supar Expandar E, for U.S. and Euro- 
pean He. LIcensad by Applied Enginaar- 
Ing. 100% replacement for extended 
80 column card. Expands Apple- 
works dasklop to 998K and allows 
instant switching between Apple- 
works modules. 0K $59 
Supar Expandar C. expands lie to 
1152K and Appleworks dasktap to 
1082K, plus allows instant switching 
between modules. |K S89 
Supar Expandar +, operates in any ll-i- 
slot, plus 0. Expands Appleworks 
datktop to IOt4K, & allows instant 
switching between modules. (80 Col 
req for Appleworks), tK S79 

ABOVE W/Z56K. 512K. or 1 MEG CALL 

QUIET COOUNG FANS 

SuperFan II for the ll+/lla. 

Kensington style w/surge protect. $26 

Supar Coolar GS for the llgs. 

No audio line interference. $24 



APPLE COMPATIBLE PERIPHERALS 

64K/80 Column Board expands He to 
128K and adds 80 columns & hi-res. $35 
Supar 64K/Ba Calumn Board w/64K $49 
Supar 64K/80 Column Board W/256K call 
16K RAM Board expands Ik to &4K $34 
12BK RAM BD expands 11+ to 192K. 
Combine w/Plusworks 2 for 11+ Ap- 
pleworks desktop of 136K. $84 
Pluiworks 2 Software allows 11+ 
Appleworks operation, (req 80 col). $38 
80 Column 80 expands 11+ display to 
80 columns. (Videx compatible). $48 
Supar Serial Board 100% replacement 
for the Super Serial card. $48 
Z80 CP/M Board opens the World of 
CPIt* for your ll+/lle/llgs. $34 
Graphic Parallel Board w /Cable does 
text & graphic screen prints. $44 
Parallel Board w /Cable for use where 
graphics is not required. $35 
Bisk Drive S'Aw/speed adjust, specify 
your model w/order. $119 



A/B Swttchbox parallel or serial 
A/B/C/0 Switchbax (par or ser) 
Numarlc Kaypad II for lla 
Numaric Kaypad II for lie 
Jaysttck (specify your II model) 
Jaystiek III similar to Mach III 



$29 
$39 
$34 

$39 
$17 
$24 




TWO YEAR WARRANTY ON ALL PRODUCTS 
CALL OR WRITE FOR OUR COLOR CATALOG 

ADD S3 SHIPPING/COO OKAr/VISA/MC NO EXTRA FEE 



Mora vartallla than the floommataa by 
Boae. tMt thundaroua amplified apaaker set 
will maka all Appla spaach. music, games, 
and other sound programs come to Hie on 
any Appla model computer. 

Prepare to be blown away when you plug 
In this super powered speaker system, 
because the advanced design amplifier of 
the SoundSystem 2 provides over 3 times 
the power of any amplifier board. 

And the sound? You want believe your 
ean. because the built in 2-way stereo 
super heterodyne speakers, coupled with 
state of the art flitaring. provide an 
enhanced high quality saund. crystal dear 
to any listener. 

Release the full saund palenllal of your 
Apple computer with the versallle 
SoundSystem 2. You never knew your 
Apple could sound so goodi 



FEATURES: 

• Built in advanced design amplifier. 

• Volume control (you'll need It). 

• 2-way supar heterodyne speakers. 

• State of the art noise filtering. 

• No slot operation. 

• 100% Apple software compatible. 

• 100% Apple hardware compatible. 

Ispeeily your model with order) 

• Complete Documentation. 

• Full two year warranty. 

LOW FACTORY 

DIRECT PRICE $129 
(PAIR) 




NEXO DISTRIBUTION (619) 474-3328 10am-6pm/Mon-Fri 

914 East Bth Street, Suite 109, National City, California 92050 

Apple, ApptoworlM ami Maelnloth lr«il«m»rlM ot Appl« CompuUr, Inc. Bow Si Roommatei m lr»d«iii«ni« ot Bow Corp. 
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The Hacker's UNiMate Copy i Deprotectjon 1111% 

Super lOB Collection \ 



ALL of our Super lOB controllers (through March 1988) in 'ONE' package! 



COMPUTIST developed the ultimate copy program 
to remove copy protection from software: 

The Super lOB program. 

Since the introduction of Super lOB, COMPUTIST 
has used this flexible program to deprotect (or partially 
deprotect) dozens of commercial programs with far 
ranging protection schemes. 

Super lOB deprotects disks by using a modified RWTS 
(the subroutine in DOS which is responsible for the 
reading and writing of disk sectors) for reading from the 
protected disk and then using a normal RWTS for writing 
to the deprotected disk. 

This package contains: 

► Three disks (supplied in DOS 3.3). Each disk contains 
at least 60 Super lOB ControUets including the standard, 
swap, newswap and fast controllers. Also included is 
version 1 .5 of Super lOB, the Csaver program from 
COMPUTIST No. 13, and a Menu Hello Program that 
lists the available controllers and, when you select one, 
automatically installs it in Super lOB and RUNs the 
resulting program.* 

>■ A reprint of Disk Inspection and the Use of 

Super lOB, from COMPUTIST No. 17. This article 
explains how to write your own Super lOB controllers. 

► COMPUTIST No. 32, which contains an extensive 
article detailing the hows and whys of Super lOB vl.5 
and at least 5 articles using the new Super lOB program. 

• Several of the controllers deprotect the software 
completely with no further steps. This means that some 
programs are only minutes away from deprotection (with 
virftially no typing). 

• The issue of COMPUTIST in which each controller 
appeared is indicated in case further steps are required 
to deprotect a particular program.** 

'Requires at least 64K of memory. 
**Although some controllers will completely deprotect 
the program they were designed for, .some will not, and 
therefore require their corresponding issue of 
COMPUTIST to complete the deprotection procedure. 



The SUPER lOB Collection 

Volume 1 of the Super lOB collection covers all the controllers from COMPUTIST No. 9 through No. 26. 
Also included are the newswap and fast controllers from COMPUTIST No. 32. The following 60 controllers 
are on volume 1 : 

Advanced Blackjack, Alphabet Zoo, Arcade Machine, Archon II, Archon, ArtscI Software, Bank Street Writer, 
Barrens SAT, Beyond Castle Wolfenstein, BSW lie Loader, Castle Wolfenstein, Computer Preparation: SAT, 
Dazzle Draw, DB Master 4 Plus, Death in the Carribean, Dino Eggs, DLM Software, Electronic Arts, F-1 5 Strike 
Eagle, Fast Controller, Fathoms 40, Financial Cookbook, Gessler Software, Grandma's House, The Heist, In 
Search of the Most Amazing Thing, Instant Recall, Kidwriter, Lions Share, Lode Runner, Mastertype, Match 
Maker, Miner 2049er, Minit Man, Mufplot, Newsroom, Newswap controller. Penguin Software, Print Shop Graphic 
Library, Print Shop, Rendezvous with Rama, Rockys' Boots, Sargon III, Sea Dragon, Shiela, Skyfox, Snooper 
Troops, Standard controller. Stoneware Software, Summer Games, Super Controller, Super Zaxxon, Swap 
Controller, TAC, Ultima I & II, Word Challenge, Xyphus, Zaxxon 

Volume 2 of the Super lOB collection covers all the controllers from COMPUTIST No. 27 through No. 
38. The following 65 controllers are on volume 2: 

Alice in Wonderland, Alphabetic Keytioarding, Alternate Reality, Autoduel, Checkers, Chipwits, Color Me, 
Conan.data, Conan.prog, CopyDOS, Crisis Mountain, Disk Director, Dragonworld, Early Games, Easy as ABC, 
F-1 5 Strike Eagle, Fantavision, Fast controller, Fishies, Flight Simulator, Halley Project, Hartley Software (a). 
Hartley Software (b), Jenny of the Prarie, Jingle Disk, Kidwriter, Kracking Vol 11, Lode Runner, LOGO II (a), 
LOGO II (b), Masquerade, Mastering the SAT, Microtype: The Wonderful World of Paws, MIcrozines 1 , Microzlnes 
2-5, Miner 2049er, Mist & View to a Kill, Murder on the Zindemeuf, Music Construction Set, Newswap controller, 
Olympic Decathlon, Other Side, Phi Beta Filer, Pitslop II, Print Shop Companion, RDOS, Robot War, Spy vs 
Spy, Standard controller, Sundog V2, Swap controller. Sword of Kadash, Synergistic Software, Tawala's Last 
Redoubt, Terripin Logo, Threshold, Time is Money, Time Zone, Tink! Tonk!, Troll's Tale, Ultima IV, Wilderness, 
Word Attack & Classmate, World's Greatest Baseball, World's Greatest Football 

Volume 3 of the Super lOB collection covers all the controllers from COMPUTIST No. 39 through No. 
53. The following 89 controllers are on volume 3: 

24(DO A.D., Alternate Reality: The Dungeon, Address Book, American Challenge, Apple Gradebook V2.6, Arcade 
Album #1 , Arcade Boot Camp, Aztec, Bard's Tale II, Beachhead, Beyond Castle Wolfenstein, Black Magic, 
Blue Powder/Grey Smoke, Borrowed Time, Castle Wolfenstein, Cat-N-Mouse, Catalyst 2.0 & 3.0, Centipede, 
Championship Golf, Championship Wrestling, Charlie Brown 123'S, Colonial Conquest, Comprehension Skills, 
Computer Preparation for the SAT V3, Coveted Mirror, Coveted Mirror RWTS Capture, CPU68(ZXZ)ONV.4Q2, 
Cranston Manor, Crime Stopper, Dam Busters, Decimals, Destroyer, Dino Dig, Earth Ort)it Statton, Encyctopedia 
Britannica, Escape, Fish Scales, Foundation Course in Spanish, Frog, QFL Football, Goonies, Great American 
Cross-Country Road Race, Handlers, H.E.R.O, Inferno, Information Master, J-Bird, Jenny's Journeys, Joe 
Theisman Football, Kindercomp, Kung Fu, Light Simulator, Manuscript Manager, Master Diagnostics He, 
Mastering Math, MECC, MECC Software, MECC Swap, MECC Without RWTS, Missing Links, No Error Check 
& No DOS, Ogre, One On One, Oregon Trail, Penguin Software, PFS ProDOS, Pitfall II, Puzzles&Posters, 
Racter, Randamn, Reading Style Inventory, Ring Quest, Science Toolkit, Science Toolkit Revi, Skyfox, Snooper 
Troops, Speed Reader II, Spy's Adventure, Starcross, Super Bunny, Temple Apshai Trilogy, The American 
Challenge, Translyvanla, Troll Courseware, Ultima I, Ultima IV, Wizard's Crown, Word Attack, Word Maze, 
World Karate Championship, Rings of Zilfin, Zorro 



■ Yes, please send me The Super lOB Collection 

Includes all three disks with Super lOB version 1.5, COMPUTIST #32, PLUS 
a reprint of "Disk Inspection and the Use of Super JOB". 

D US/Canada/Mexico — All three volumes . . . $24.00 

D Other Foreign — All three volumes $30.00 

D US/Canada/Mexico - Volume #3 only $9.00 

D Other Foreign — Volume #3 only $12.00 

Send to: Super lOB Collection 

PC Box 110846-T 
Tacoma, WA 98411 



Name. 



.ID#. 



Address. 

City 

Country 



_State_ 



_Zip_ 



Phone 



Exp. 



.CP61 



or call: (206) 474-5750 for 



or 



orders. 



Signature 

Most orders are shipped within 5 working days, however, please allow 
4 to 6 weeks for delivery. Washington residents, please add 7.8% sales tax. 

US funds drawn on US banks 



November 
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Legends tell of the days when the ancient back issues of Hardcore COMPUTIST were readily available to anyone who wished to purchase them. 
Those days may be long past, but the treasures within those ancient documents has been diligently transcribed to the pages of a modern reference work: 

The Book(s) of Softkeys 



Volume I Compiled from issues 1-5 

contains softkeys for: •Akalabeth •Ampermagic 'Apple Galaxian •Aztec •Bag of Tricks •Budge's Trilogy 
•Buzzard Bait •Cannonball Blitz •Casino •Data Reporter •Deadline •Disk Organizer II 'Egbert II 
Communic. Disk •Hard Hat Mack •Home Accountant •Homeword •Lancaster •Magic Window II •Multi- 
disk Catalog •Multiplan 'Pest Patrol •Prisoner II •Sammy Lightfoot •Screen Writer II •Sneakers •Spy's 
Demise •Starcross •Suspended •Ultima II •Visifile •Visiplot 'Visitrend •Witness •Wizardry •Zork I •Zork 
II •Zork III D PLUS 'how-to' articles and listings of need-to-have programs used to make unprotected 
backups. 

Volume II Compiled from issues 6-10 

contains softkeys for: •Apple Cider Spider 'Apple Logo •Artist Arcade Machine 'Bank Street Writer 
•Cannonball Blitz •Canyon Climber •Caverns of Freitag •Crush, Crumble & Chomp 'Data Factory V •DB 
Master •The Dic*tion*ary •Essential Data Duplicator I & III •Gold Rush •Krell Logo •Legacy of Llylgamyn 
•Mask Of The Sun •Minit Man •Mouskattack •Music Construction Set •Oil's Well •Pandora's Box 
•Robotron •Sammy Lightfoot •Screenwriter II v2.2 •Sensible Speller 4, 4c, 4.1c •Spy Strikes Back •Time 
Zone vl.l •Visible Computer: 6502 'Visidex 'Visiterm •Zaxxon • software for: •Hayden •Sierra Online 
D PLUS the ultimate cracking program: Super lOB 1.5 •••and more! 



Volume III Compiled from issues 11-15 

contains softkeys for: •Alien Addition •Alien Munchies •Alligator Mix •Comp. Prep. SAT •Cut & Paste 
•Demolition Division. •DLM software •EA (Electronic Arts) software •Einstein Compiler 5.3 •Escape From 
Rungistan •Financial Cookbook •Flip Out •Hi-res Computer Golf II •Knoware •Laf Pak •Last Gladiator 
•Learning With Leeper •Lion's Share •Master Type 1.7 •MatheMagic •Minus Mission •Millionaire •Music 
Construction Set •One-on-one •Penguin software •PFS software 'The Quest •Rooky's Boots •Sabotage 
•Seadragon •Sensible Speller 4 •Snooper Troops II •SoftPorn Adventure •Stickybear series •Suicide 
•TellStar •Tic Tac Show •Time Is Money •Transylvania •Type Attack •Ultima III Exodus •Zoom Graphics 
•Breaking Locksmith 5.0 Fast Copy D PLUS feature articles on • Csaver • The Core Disk Searcher 
• Modified ROMs. 



Name. 



.ID#_ 



Address. 
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State 



Zip 



Country 

Signature. 



_ Phone _ 



Exp. 



_CP61 



□ Volume I - $7.95 

+ $2 shipping/handling 

□ Volume II - $12.95 
+ $2 shipping/handling 

□ Volume III - $17.95 
-1-52 shipping/handling 

□ Ail 3 volumes! - $30.00 
+ $2 shipping/handling 



Foreign orders (except Canada and Mexico) please add $5 per book for shipping and handling. Washington residents add 7.8% sales tax. 
Most orders are shipped within 5 working days, however, please allow 4-6 weeks delivery. US Funds drawn on US banks only. 

Send to: Book of Softkeys PO Box 1 10846-T Tacoma, WA 9841 1 (206) 474-5750 
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